SaaS transparency ranking · Finance and legal
Expense management software
35 vendors · updated 2026-10-16 · 3 without enough data for a score
Expense and spend management tools, ranked by what they publish about how they handle your financial data.
Public transparency score, not a product or security rating. Transparency means: published on the vendor's own site, readable without a login, found by us at the addresses we checked.
+3points above the median of every category we measure
- Expense management20
- All categories17
- A0 0%
- B1 3%
- C1 3%
- D8 25%
- E3 9%
- F19 59%
- Data processing agreement5, filter to these
- Subprocessor list1, filter to these
- Data location stated9, filter to these
- Status page with history9, filter to these
- Band B1, filter to these
- Band C1, filter to these
-
1
Brexbrex.comTransparency 70/100 BBand B
- Data processing agreement: found
- Subprocessor list: not found
- Data location stated: found
- Status page with history: found
- Public pricing: found
- Certifications named: found
- Uptime SLA with a figure: not found
- HTTPS enforced with HSTS: found
- No third-party tracking before consent: not found
- security.txt (RFC 9116): not found
- Notice before subprocessors change: found
- Named privacy contact: found
8 found4 gapsGaps Subprocessor list, No third-party tracking before consent, +2Transparency alternatives
-
2
Payhawkpayhawk.comTransparency 57/100 CBand C
- Data processing agreement: found
- Subprocessor list: not found
- Data location stated: found
- Status page with history: not found
- Public pricing: not found
- Certifications named: found
- Uptime SLA with a figure: not found
- HTTPS enforced with HSTS: found
- No third-party tracking before consent: not found
- security.txt (RFC 9116): found
- Notice before subprocessors change: found
- Named privacy contact: found
7 found5 gapsGaps Subprocessor list, Status page with history, +3Transparency alternatives
-
3
Klippaklippa.comTransparency 52/100 DBand D
- Data processing agreement: found
- Subprocessor list: not found
- Data location stated: found
- Status page with history: found
- Public pricing: not found
- Certifications named: found
- Uptime SLA with a figure: not found
- HTTPS enforced with HSTS: found
- No third-party tracking before consent: not found
- security.txt (RFC 9116): found
- Notice before subprocessors change: not found
- Named privacy contact: not found
6 found6 gapsGaps Subprocessor list, Public pricing, +4Transparency alternatives
-
4
Rydoorydoo.comTransparency 52/100 DBand D
- Data processing agreement: not found
- Subprocessor list: not found
- Data location stated: found
- Status page with history: found
- Public pricing: found
- Certifications named: found
- Uptime SLA with a figure: not found
- HTTPS enforced with HSTS: found
- No third-party tracking before consent: not found
- security.txt (RFC 9116): found
- Notice before subprocessors change: not found
- Named privacy contact: found
7 found5 gapsGaps Data processing agreement, Subprocessor list, +3Transparency alternatives
-
5
Navannavan.comTransparency 48/100 DBand D
- Data processing agreement: found
- Subprocessor list: not found
- Data location stated: not found
- Status page with history: not found
- Public pricing: found
- Certifications named: found
- Uptime SLA with a figure: not found
- HTTPS enforced with HSTS: found
- No third-party tracking before consent: not found
- security.txt (RFC 9116): not found
- Notice before subprocessors change: found
- Named privacy contact: found
6 found6 gapsGaps Subprocessor list, Data location stated, +4Transparency alternatives
-
6
Tipaltitipalti.comTransparency 48/100 DBand D
- Data processing agreement: found
- Subprocessor list: not found
- Data location stated: found
- Status page with history: not found
- Public pricing: found
- Certifications named: not found
- Uptime SLA with a figure: not found
- HTTPS enforced with HSTS: found
- No third-party tracking before consent: not found
- security.txt (RFC 9116): not found
- Notice before subprocessors change: not found
- Named privacy contact: found
5 found7 gapsGaps Subprocessor list, Status page with history, +5Transparency alternatives
-
7
Emburseemburse.comTransparency 43/100 DBand D
- Data processing agreement: not found
- Subprocessor list: not found
- Data location stated: found
- Status page with history: not found
- Public pricing: not found
- Certifications named: found
- Uptime SLA with a figure: not found
- HTTPS enforced with HSTS: found
- No third-party tracking before consent: not found
- security.txt (RFC 9116): found
- Notice before subprocessors change: found
- Named privacy contact: found
6 found6 gapsGaps Data processing agreement, Subprocessor list, +4Transparency alternatives
-
8
ExpenseInexpensein.comTransparency 43/100 DBand D
- Data processing agreement: not found
- Subprocessor list: found
- Data location stated: found
- Status page with history: not found
- Public pricing: not found
- Certifications named: found
- Uptime SLA with a figure: not found
- HTTPS enforced with HSTS: found
- No third-party tracking before consent: not found
- security.txt (RFC 9116): not found
- Notice before subprocessors change: not found
- Named privacy contact: found
5 found7 gapsGaps Data processing agreement, Status page with history, +5Transparency alternatives
-
9
Expensifyexpensify.comTransparency 43/100 DBand D
- Data processing agreement: not found
- Subprocessor list: not found
- Data location stated: found
- Status page with history: found
- Public pricing: found
- Certifications named: not found
- Uptime SLA with a figure: not found
- HTTPS enforced with HSTS: found
- No third-party tracking before consent: not found
- security.txt (RFC 9116): not found
- Notice before subprocessors change: not found
- Named privacy contact: found
5 found7 gapsGaps Data processing agreement, Subprocessor list, +5Transparency alternatives
-
10
Spendeskspendesk.comTransparency 43/100 DBand D
- Data processing agreement: not found
- Subprocessor list: not found
- Data location stated: found
- Status page with history: found
- Public pricing: not found
- Certifications named: found
- Uptime SLA with a figure: not found
- HTTPS enforced with HSTS: found
- No third-party tracking before consent: not found
- security.txt (RFC 9116): found
- Notice before subprocessors change: not found
- Named privacy contact: found
6 found6 gapsGaps Data processing agreement, Subprocessor list, +4Transparency alternatives
-
11
Pleopleo.ioTransparency 27/100 EBand E
- Data processing agreement: not found
- Subprocessor list: not found
- Data location stated: not found
- Status page with history: found
- Public pricing: found
- Certifications named: not found
- Uptime SLA with a figure: not found
- HTTPS enforced with HSTS: found
- No third-party tracking before consent: not found
- security.txt (RFC 9116): not measured
- Notice before subprocessors change: not found
- Named privacy contact: not found
3 found8 gaps1 not measuredGaps Data processing agreement, Subprocessor list, +6Transparency alternatives
-
12
ExpenseOnDemandexpenseondemand.comTransparency 26/100 EBand E
- Data processing agreement: not found
- Subprocessor list: not found
- Data location stated: not found
- Status page with history: not found
- Public pricing: found
- Certifications named: found
- Uptime SLA with a figure: not found
- HTTPS enforced with HSTS: found
- No third-party tracking before consent: not found
- security.txt (RFC 9116): not found
- Notice before subprocessors change: not found
- Named privacy contact: found
4 found8 gapsGaps Data processing agreement, Subprocessor list, +6Transparency alternatives
-
13
Rampramp.comTransparency 26/100 EBand E
- Data processing agreement: not found
- Subprocessor list: not found
- Data location stated: not found
- Status page with history: not found
- Public pricing: found
- Certifications named: found
- Uptime SLA with a figure: not found
- HTTPS enforced with HSTS: found
- No third-party tracking before consent: not found
- security.txt (RFC 9116): found
- Notice before subprocessors change: not found
- Named privacy contact: not found
4 found8 gapsGaps Data processing agreement, Subprocessor list, +6Transparency alternatives
-
14
Mobilexpensemobilexpense.comTransparency 22/100 FBand F
- Data processing agreement: not found
- Subprocessor list: not found
- Data location stated: not found
- Status page with history: not found
- Public pricing: found
- Certifications named: not found
- Uptime SLA with a figure: not found
- HTTPS enforced with HSTS: found
- No third-party tracking before consent: not found
- security.txt (RFC 9116): not found
- Notice before subprocessors change: not found
- Named privacy contact: found
3 found9 gapsGaps Data processing agreement, Subprocessor list, +7Transparency alternatives
-
15
N2Fn2f.comTransparency 22/100 FBand F
- Data processing agreement: not found
- Subprocessor list: not found
- Data location stated: not found
- Status page with history: not found
- Public pricing: found
- Certifications named: not found
- Uptime SLA with a figure: not found
- HTTPS enforced with HSTS: found
- No third-party tracking before consent: not found
- security.txt (RFC 9116): not found
- Notice before subprocessors change: not found
- Named privacy contact: found
3 found9 gapsGaps Data processing agreement, Subprocessor list, +7Transparency alternatives
-
16
Soldosoldo.comTransparency 22/100 FBand F
- Data processing agreement: not found
- Subprocessor list: not found
- Data location stated: not found
- Status page with history: not found
- Public pricing: found
- Certifications named: found
- Uptime SLA with a figure: not found
- HTTPS enforced with HSTS: found
- No third-party tracking before consent: not found
- security.txt (RFC 9116): not found
- Notice before subprocessors change: not found
- Named privacy contact: not found
3 found9 gapsGaps Data processing agreement, Subprocessor list, +7Transparency alternatives
-
17
ExpensePointexpensepoint.comTransparency 17/100 FBand F
- Data processing agreement: not found
- Subprocessor list: not found
- Data location stated: not found
- Status page with history: found
- Public pricing: not found
- Certifications named: not found
- Uptime SLA with a figure: not found
- HTTPS enforced with HSTS: found
- No third-party tracking before consent: not found
- security.txt (RFC 9116): not found
- Notice before subprocessors change: not found
- Named privacy contact: not found
2 found10 gapsGaps Data processing agreement, Subprocessor list, +8Transparency alternatives
-
18
Findityfindity.comTransparency 17/100 FBand F
- Data processing agreement: not found
- Subprocessor list: not found
- Data location stated: not found
- Status page with history: found
- Public pricing: not found
- Certifications named: not found
- Uptime SLA with a figure: not found
- HTTPS enforced with HSTS: found
- No third-party tracking before consent: not found
- security.txt (RFC 9116): not found
- Notice before subprocessors change: not found
- Named privacy contact: not found
2 found10 gapsGaps Data processing agreement, Subprocessor list, +8Transparency alternatives
-
19
Fylefylehq.comTransparency 17/100 FBand F
- Data processing agreement: not found
- Subprocessor list: not found
- Data location stated: not found
- Status page with history: not found
- Public pricing: found
- Certifications named: not found
- Uptime SLA with a figure: not found
- HTTPS enforced with HSTS: found
- No third-party tracking before consent: not found
- security.txt (RFC 9116): not found
- Notice before subprocessors change: not found
- Named privacy contact: not found
2 found10 gapsGaps Data processing agreement, Subprocessor list, +8Transparency alternatives
-
20
Hurdlrhurdlr.comTransparency 17/100 FBand F
- Data processing agreement: not found
- Subprocessor list: not found
- Data location stated: not found
- Status page with history: not found
- Public pricing: found
- Certifications named: not found
- Uptime SLA with a figure: not found
- HTTPS enforced with HSTS: found
- No third-party tracking before consent: not found
- security.txt (RFC 9116): not found
- Notice before subprocessors change: not found
- Named privacy contact: not found
2 found10 gapsGaps Data processing agreement, Subprocessor list, +8Transparency alternatives
-
21
Webexpenseswebexpenses.comTransparency 17/100 FBand F
- Data processing agreement: not found
- Subprocessor list: not found
- Data location stated: not found
- Status page with history: not found
- Public pricing: found
- Certifications named: found
- Uptime SLA with a figure: not found
- HTTPS enforced with HSTS: not found
- No third-party tracking before consent: not found
- security.txt (RFC 9116): not found
- Notice before subprocessors change: not found
- Named privacy contact: found
3 found9 gapsGaps Data processing agreement, Subprocessor list, +7Transparency alternatives
-
22
HRworkshrworks.deTransparency 13/100 FBand F
- Data processing agreement: not found
- Subprocessor list: not found
- Data location stated: not found
- Status page with history: not found
- Public pricing: not found
- Certifications named: not found
- Uptime SLA with a figure: not found
- HTTPS enforced with HSTS: found
- No third-party tracking before consent: not found
- security.txt (RFC 9116): not found
- Notice before subprocessors change: not found
- Named privacy contact: found
2 found10 gapsGaps Data processing agreement, Subprocessor list, +8Transparency alternatives
-
23
Mooncardmooncard.coTransparency 13/100 FBand F
- Data processing agreement: not found
- Subprocessor list: not found
- Data location stated: not found
- Status page with history: not found
- Public pricing: not found
- Certifications named: not found
- Uptime SLA with a figure: not found
- HTTPS enforced with HSTS: found
- No third-party tracking before consent: not found
- security.txt (RFC 9116): not found
- Notice before subprocessors change: not found
- Named privacy contact: found
2 found10 gapsGaps Data processing agreement, Subprocessor list, +8Transparency alternatives
-
24
Vroozivroozi.comTransparency 13/100 FBand F
- Data processing agreement: not found
- Subprocessor list: not found
- Data location stated: not found
- Status page with history: not found
- Public pricing: not found
- Certifications named: not found
- Uptime SLA with a figure: not found
- HTTPS enforced with HSTS: found
- No third-party tracking before consent: not found
- security.txt (RFC 9116): not found
- Notice before subprocessors change: not found
- Named privacy contact: found
2 found10 gapsGaps Data processing agreement, Subprocessor list, +8Transparency alternatives
-
25
Airbaseairbase.comTransparency 9/100 FBand F
- Data processing agreement: not found
- Subprocessor list: not found
- Data location stated: not found
- Status page with history: found
- Public pricing: not found
- Certifications named: not found
- Uptime SLA with a figure: not found
- HTTPS enforced with HSTS: not found
- No third-party tracking before consent: not found
- security.txt (RFC 9116): not found
- Notice before subprocessors change: not found
- Named privacy contact: not found
1 found11 gapsGaps Data processing agreement, Subprocessor list, +9Transparency alternatives
-
26
Expense8expense8.comTransparency 9/100 FBand F
- Data processing agreement: not found
- Subprocessor list: not found
- Data location stated: not found
- Status page with history: not found
- Public pricing: not found
- Certifications named: not found
- Uptime SLA with a figure: not found
- HTTPS enforced with HSTS: found
- No third-party tracking before consent: not found
- security.txt (RFC 9116): not measured
- Notice before subprocessors change: not found
- Named privacy contact: not found
1 found10 gaps1 not measuredGaps Data processing agreement, Subprocessor list, +8Transparency alternatives
-
27
SAP Concurconcur.comTransparency 9/100 FBand F
- Data processing agreement: not found
- Subprocessor list: not found
- Data location stated: not found
- Status page with history: not found
- Public pricing: not found
- Certifications named: not found
- Uptime SLA with a figure: not found
- HTTPS enforced with HSTS: not found
- No third-party tracking before consent: not found
- security.txt (RFC 9116): found
- Notice before subprocessors change: not found
- Named privacy contact: found
2 found10 gapsGaps Data processing agreement, Subprocessor list, +8Transparency alternatives
-
28
Shoeboxedshoeboxed.comTransparency 9/100 FBand F
- Data processing agreement: not found
- Subprocessor list: not found
- Data location stated: not found
- Status page with history: not found
- Public pricing: found
- Certifications named: not found
- Uptime SLA with a figure: not found
- HTTPS enforced with HSTS: not found
- No third-party tracking before consent: not found
- security.txt (RFC 9116): not found
- Notice before subprocessors change: not found
- Named privacy contact: not found
1 found11 gapsGaps Data processing agreement, Subprocessor list, +9Transparency alternatives
-
29
Spesenfuchsspesenfuchs.deTransparency 9/100 FBand F
- Data processing agreement: not found
- Subprocessor list: not found
- Data location stated: not found
- Status page with history: not found
- Public pricing: not found
- Certifications named: not found
- Uptime SLA with a figure: not found
- HTTPS enforced with HSTS: found
- No third-party tracking before consent: not found
- security.txt (RFC 9116): not found
- Notice before subprocessors change: not found
- Named privacy contact: not found
1 found11 gapsGaps Data processing agreement, Subprocessor list, +9Transparency alternatives
-
30
Volopayvolopay.comTransparency 9/100 FBand F
- Data processing agreement: not found
- Subprocessor list: not found
- Data location stated: not found
- Status page with history: not found
- Public pricing: found
- Certifications named: not found
- Uptime SLA with a figure: not found
- HTTPS enforced with HSTS: not found
- No third-party tracking before consent: not found
- security.txt (RFC 9116): not found
- Notice before subprocessors change: not found
- Named privacy contact: not found
1 found11 gapsGaps Data processing agreement, Subprocessor list, +9Transparency alternatives
-
31
WellyBoxwellybox.comTransparency 9/100 FBand F
- Data processing agreement: not found
- Subprocessor list: not found
- Data location stated: not found
- Status page with history: not found
- Public pricing: found
- Certifications named: not found
- Uptime SLA with a figure: not found
- HTTPS enforced with HSTS: not found
- No third-party tracking before consent: not found
- security.txt (RFC 9116): not found
- Notice before subprocessors change: not found
- Named privacy contact: not found
1 found11 gapsGaps Data processing agreement, Subprocessor list, +9Transparency alternatives
-
32
Centergetcenter.comTransparency 4/100 FBand F
- Data processing agreement: not found
- Subprocessor list: not found
- Data location stated: not found
- Status page with history: not found
- Public pricing: not found
- Certifications named: not found
- Uptime SLA with a figure: not found
- HTTPS enforced with HSTS: not found
- No third-party tracking before consent: not found
- security.txt (RFC 9116): not found
- Notice before subprocessors change: not found
- Named privacy contact: found
1 found11 gapsGaps Data processing agreement, Subprocessor list, +9Transparency alternatives
-
Circulacircula.comNot enough data: 3 of 12 criteria measured, so no transparency score
- Data processing agreement: not measured
- Subprocessor list: not measured
- Data location stated: not measured
- Status page with history: not measured
- Public pricing: not measured
- Certifications named: not measured
- Uptime SLA with a figure: not measured
- HTTPS enforced with HSTS: not found
- No third-party tracking before consent: not found
- security.txt (RFC 9116): not found
- Notice before subprocessors change: not measured
- Named privacy contact: not measured
0 found3 gaps9 not measuredGaps HTTPS enforced with HSTS, No third-party tracking before consent, +1
-
Coupacoupa.comNot enough data: 3 of 12 criteria measured, so no transparency score
- Data processing agreement: not measured
- Subprocessor list: not measured
- Data location stated: not measured
- Status page with history: not measured
- Public pricing: not measured
- Certifications named: not measured
- Uptime SLA with a figure: not measured
- HTTPS enforced with HSTS: found
- No third-party tracking before consent: not found
- security.txt (RFC 9116): not found
- Notice before subprocessors change: not measured
- Named privacy contact: not measured
1 found2 gaps9 not measuredGaps No third-party tracking before consent, security.txt (RFC 9116)
-
Mossgetmoss.comNot enough data: 2 of 12 criteria measured, so no transparency score
- Data processing agreement: not measured
- Subprocessor list: not measured
- Data location stated: not measured
- Status page with history: not measured
- Public pricing: not measured
- Certifications named: not measured
- Uptime SLA with a figure: not measured
- HTTPS enforced with HSTS: found
- No third-party tracking before consent: not found
- security.txt (RFC 9116): not measured
- Notice before subprocessors change: not measured
- Named privacy contact: not measured
1 found1 gap10 not measuredGaps No third-party tracking before consent
-
Tick 2 vendors to compare them. 0 of 2 selected 1 of 2 selected 2 of 2 selected More than 2 selected. A comparison sets 2 side by side.
Before the demo
Buying expense software: follow the receipt
Test the entire route from employee submission to the accounting handover. Use invented expenses and the same approval roles in every trial.
Capture and corrections
Try an unclear receipt, a duplicate and a foreign-currency expense. Record which fields need manual correction and what happens after an approved expense is changed.
Approval and access
Use employee, reviewer and finance accounts. Reject an expense, delegate a review and check whether the employee can see another team’s receipts.
Accounting handover
Export the same sample twice. Ask finance to reconcile receipt references, payment method and cost centres and to explain how it would recover a failed transfer.
Full trial checklist and CSV worksheet
A trial you can repeat
Submit five invented expenses, reject and correct one, then export the approved pack. Have finance reconcile every receipt and repeat the transfer to test duplicates.
Spesenfuchs documents capture, approvals and accounting export separately. These are useful stages to test with any shortlisted product. Spesenfuchs: workflow features. Source reviewed 2026-10-02. The trial questions are editorial guidance, not additional measured criteria.
Narrow it down
Each of these lists the Expense management vendors that meet one condition, with the source for each, and appears only where at least 8 of them meet it.
- Expense management vendors with public pricing 17
- Expense management vendors with a status page with history 9
- Expense management vendors with a named privacy contact 18
This category, criterion by criterion
How this market does on each criterion, with its own share and how it compares with the rest.
- Data processing agreement
- Subprocessor list
- Data location stated
- Status page with history
- Public pricing
- Certifications named
- Uptime SLA with a figure
- HTTPS enforced with HSTS
- No third-party tracking before consent
- security.txt (RFC 9116)
- Notice before subprocessors change
- Named privacy contact
Head-to-head comparisons
Each comparison lists only the criteria where the two differ, with the source for every one. All comparisons.
Every result links its source on the vendor page. A grey segment means we could not measure it, not that it is missing. See how we score.