Exkit
Effective October 31, 2026 · Published by Asymptoticsolutions LLC
Exkit is an expense service that companies build into their own apps and systems. Employees photograph receipts in their company's app, and the company reviews and approves the expenses. We do not sell your data, use it for advertising, or track you.
Exkit does not receive your name or email address from the app, and it does not collect your location, contacts or advertising ID.
To use the Exkit portal, staff provide an email address and a password, and optionally set up an authenticator app. Companies also provide their name, settings, categories and logo. Sign-in is handled by Amazon Cognito, and we do not store passwords ourselves.
We store expense data only while your company is our customer, and for at most 24 months from the day we receive it. Your company can choose a shorter period. Exkit is not a legal archive: your company must download its data and keep it for as long as the law requires.
The only thing we keep for 10 years is the signed integrity files described below. They are not your expense data. Deletion runs daily, and ledger entries, which hold only identifiers and hashes, can stay a little longer until their integrity check completes.
| Data | How long |
|---|---|
| Receipt photo and draft on your device | Until the expense is submitted or you delete the draft. Your company's app can also erase local data. |
| Expenses and receipt photos on our servers | For the period your company chooses, at most 24 months. They are deleted sooner if your company deletes its Exkit account or tenant. |
| Approved expenses | The same period, at most 24 months. Until then they are sealed: signed and unchangeable, so the record can be trusted. They can be voided but not edited. |
| Signed integrity files | 10 years, even after an account is deleted, and they cannot be deleted sooner. They hold only technical identifiers, timestamps, hashes (fingerprints of records) and public keys, with no receipt images, amounts or descriptions. They can prove a record was not altered, but cannot restore it. |
| Account details: company settings and categories, staff accounts, Exkit user IDs, linked references (hashed) and device records | While your company is our customer. Deleted with the account or tenant. |
| Account activity log: settings changes, keys and sign-in administration | The same period your company chooses, at most 24 months. |
| Record that an account was deleted: company name, date and who asked | 24 months after the deletion. |
| Data exports | 31 days. |
| Technical logs | 30 days. |
| Database backups | Up to 35 days after data is deleted. |
Asymptoticsolutions LLC is based in the United States, so our staff may access data from there when needed to run and support the service. Our operator console shows account details and usage counts, not expense content or receipts, and Exkit gives our operators no function to download customer data. Your company downloads its own data. Our operators can invite an owner to a company's account, for example to restore lost access, and the company can see every member of its account. We may disclose data if the law requires it.
Depending on where you live, you may have the right to access, correct or delete your data, or to object to or restrict its use. If you are an employee, please contact your company first: it controls your expense data and may have to keep it as a business record. We help it respond. Staff can contact us directly. In the EU, UK and Switzerland you can also complain to your data protection authority.
Exkit is a workplace service and is not directed at children.
If this policy changes, we will update this page and its effective date.
Asymptoticsolutions LLC · info@asymptoticsolutions.com · asymptoticsolutions.com