An invoice looks like a simple document — a vendor name, a few line items, a total. Look closer and it’s often carrying your ABN, your bank account details, your customers’ names and addresses, and in a B2B setting, the actual prices you pay your suppliers. That’s a lot of sensitive material to hand to a website you’ve never used before, just to save ten minutes of typing.
Free "invoice to Excel" and "PDF to Excel" tools are everywhere, and most of them work fine on the surface — upload a file, get back a spreadsheet. What’s much less visible is what happens to your file in between. Here’s what’s actually worth checking, and four questions we think you should ask of any tool before uploading a real invoice — including ours.
What's actually on an invoice, and why it matters
- Supplier invoices often carry banking details (BSB/account number) for payment — exactly the data targeted in invoice-redirection fraud.
- ABNs and vendor names reveal who you work with, which is useful to competitors and scammers alike.
- Sales invoices carry your customers’ names, addresses, and what they paid — commercially sensitive if it leaks.
- None of this is risky sitting in your own accounting system. It becomes a risk the moment it leaves your control.
Four questions to ask before uploading any invoice, anywhere
- Does it store the file, and for how long? Vague language like "we may retain your data" with no stated duration is a red flag — look for an explicit statement about file handling, not a general privacy policy that never mentions files at all.
- Is it encrypted in transit? Check for HTTPS at minimum. Anything sent over plain HTTP can be intercepted on the way.
- Who else sees it? If a tool uses a third-party AI or OCR provider, that provider is another party holding your data. A tool that names its processor is being more transparent than one that just says "our systems."
- Can you actually get your data deleted? Under the Australian Privacy Act and GDPR you can ask — but only if there’s someone accountable to ask. No visible privacy contact usually means that right is theoretical.
Red flags worth walking away from
- No privacy policy, or one that’s generic boilerplate with no mention of file or document handling
- Forced account creation before you can test the tool with a single file
- No mention of encryption, storage duration, or where processing happens
- Terms that grant a broad licence to use your uploads to "improve our services" — a common way free AI tools fund themselves by training on user data
How Ledgr Invoice answers each of these
We extract our own supplier invoices with this same tool, so we ran it against this exact checklist before writing a line of code. Here’s where we land:
- Storage: none. Files are processed entirely in memory on the server and discarded the moment extraction finishes — never written to disk.
- Encryption in transit: TLS 1.2+ on every connection, enforced site-wide.
- Who else sees it: invoice content is sent to Anthropic’s Claude API in the United States for extraction — disclosed on our Privacy Policy, and Anthropic does not use API data to train its models.
- Deletion rights: under the Australian Privacy Act and GDPR, you can access, correct, or delete stored account data at any time — email privacy@ledgrinvoice.au.
- No forced signup: the free tier (3 extractions/day) needs no account, so you can test the actual extraction with a real invoice before deciding to trust us with anything else.
This isn’t a pitch to take our word for it — it’s a checklist you can run against any tool, including this one.
A five-question checklist for any invoice tool
- Does the privacy policy specifically mention file or document handling — not just "personal data" in the abstract?
- Is there a stated storage duration, or an explicit confirmation of no storage?
- Is the connection encrypted (HTTPS)?
- Are third-party processors (AI providers, OCR engines) named?
- Is there a named contact for privacy questions or deletion requests?
If a tool can't answer most of these clearly, that's worth knowing before you upload something with your bank details on it — not after.
Read our full Privacy Policy, or try the extraction yourself — 3 free extractions a day, no account required.
Try the live demo