Security
Your data
What happens to the data you upload, where it is held, and who else touches it. If your IT function needs something this page does not answer, write to contact at lupa dot energy.
Where your data is held
Customer data is stored by Supabase in its West EU region, in Ireland. That covers the database, the account records and the stored files, which are the half-hourly interval data and the analysis outputs.
What happens to an invoice
An uploaded invoice is read once, in the request that parses it, and is not stored. What is kept is the tariff that was reconstructed from it: the rates, the bands and the charges. The file itself is not written to disk or to storage at any point. This is a property of how the software is built rather than a policy that could be relaxed quietly.
Artificial intelligence
Bill parsing sends the contents of an invoice to Anthropic's API from the server. It is never called from a browser, so an API key is never exposed. Anthropic does not train its models on data sent through its API. Neither do we: customer data is never used to train or improve any model, and never will be.
Who else processes your data
- Supabase. Database, authentication and file storage. Ireland.
- Vercel. Application hosting. Ireland.
- Modal. Runs the modelling engine. European Union. Modal routes the request and its result through its control plane in the United States, while the modelling itself runs on European machines.
- Anthropic. Bill parsing. United States.
- Resend. Outgoing email. Ireland.
- Calendly. Booking Lupa Live onboarding calls: the name, email address and notes given when a call is booked. United States.
Access and separation
Every row of customer data carries the identifying mark of the company that owns it, and the database enforces that a signed-in browser can only read its own company's rows. Application routes check the same thing again in code. A person joining a company has no access until an administrator approves them.
If an account closes
Data is kept rather than deleted when access ends, so that it can be restored or exported. A copy can be requested by writing to contact at lupa dot energy. The retention periods are on the privacy page.
What this page is not
No formal certification is claimed. There is no ISO 27001 certificate and no SOC 2 report, and saying otherwise would be untrue. What is described here is how the system is built.