LeoCore DMS · Sovereign document vault
Every document sealed. In your account, not ours.
Photograph a bill on your phone. It reads itself — vendor, date, total, VAT. You check the fields and seal it. The image lands in your cloud storage and the index row in your database, under a token you issue and can revoke in one click. Once sealed, the row cannot be edited by anyone, including us.
~5 seconds from photo to reviewed fields Unlimited users on every paid plan Zero client documents on LeoCore infrastructure
The problem
A shoebox of receipts is not an archive. Nor is a shared drive.
Nobody can prove it wasn’t changed
A PDF on a network drive can be replaced at any time and the file date rewritten. Tax authorities permit electronic records on the condition that they cannot be altered — a folder cannot meet that on its own, whichever revenue service is asking.
Keying it in twice, badly
Somebody reads the total off the paper and types it into the accounts. Software that assumes two decimal places turns 84.735 into 84.74, and 1,200 yen into 1,200.00 — nobody notices until a reconciliation fails.
You cannot see who looked
Ordinary document systems record who may open a folder. Almost none record who actually did — least of all when the vendor’s own support team opens it.
How it works
Four steps, and one of them is irreversible on purpose.
Capture
On a phone, the app opens the rear camera directly. The image is downscaled to 2048px and compressed to roughly 300 KB on the device before it goes anywhere, so a site visit over mobile data is not a problem. A scanner mode finds the page in the viewfinder, fires the shutter once the picture stops moving, and squares up a document photographed at an angle so the small print reads straight. Crop, straighten and rotate run against the full-resolution original, never the compressed copy. PDFs are accepted and stored unaltered so their text layer survives. On a PC, select a whole folder at once — they queue up and you work through them one at a time.
Extract
Claude reads the document and returns vendor, document date, sub-total, VAT, total, a category and a confidence rating — typically in about five seconds. The call is made with your Anthropic key, so the document reaches your account and LeoCore appears in neither the content nor the billing record. If extraction is unavailable the operator keys the fields by hand and nothing stops.
Verify
Nothing is written until a person confirms it. Low-confidence fields are
highlighted. The date is typed in a fixed DD-MM-YYYY order rather
than picked from a browser calendar — a native picker paints its value in
the browser’s locale, so the same receipt reads 09/07 on a phone and
07/09 on a desk, and the row cannot be edited afterwards. Amounts follow the
workspace currency, from its ISO 4217 minor unit — the dinars carry three
decimals, the yen none, most of the world two.
Seal
The image is written to your storage under a readable key
— 2026/09/Expense_Bill/BATELCO_2026-09-11_84.735_BHD.webp —
and the index row to your database, stamped with the signed-in identity of
whoever sealed it. From that moment the row is immutable: update and delete
are refused at the edge and by triggers inside your own database.
A correction is posted as a new entry, the way a ledger has always worked.
What makes this different
We built a door. The vault is yours.
Every other document system in this market asks you to upload your records to the vendor’s cloud and then trust their policy. LeoCore DMS inverts that. Your documents are written to storage you own, in an account you control, and we reach it per-request with a scoped token you issued.
Your storage
Document images go to a Cloudflare R2 bucket in your own Cloudflare account. Not a folder inside ours. The bucket is never public; images are streamed back through an authenticated proxy.
Your database
Index rows — vendor, date, amounts, the object key — go to a Cloudflare D1 database in your account. LeoCore’s own database holds connection profiles and access grants only. Never a document, a vendor name, or an amount.
Your AI account
Extraction runs on your Anthropic key, billed to you at cost. There is no platform key and no fallback: your documents never travel through a LeoCore credential, and we never mark up a token.
Your off switch
Access is a scoped API token you create with exactly two permissions
— R2 Storage: Edit and D1: Edit. Revoking it in your
Cloudflare dashboard severs LeoCore’s access immediately and completely.
You do not need to ask us, and we cannot stop you.
Your audit of us
A workspace owner can open the access log and see every request made against their vault, who made it, and when — including any use of LeoCore’s break-glass support key, which is flagged as such. A sovereignty claim nobody can check is a marketing line; this one is a table in your own console.
Features
Built for the person holding the paper, and the person auditing it.
One deployment, two shapes: a one-handed capture utility on a phone, and a widescreen split-pane workstation for whoever has to find things later.
AI field extraction
Vendor, document date, the bill or invoice number as printed, sub-total, VAT, total, currency, category and sub-category, with a confidence rating that flags what needs a second look. Works on photographs and on PDFs.
Tamper-evident, and checkable without us
Every sealed row is hashed together with the hash of the row before it, so altering any record breaks every link after it. The whole chain exports with the arithmetic printed alongside, and a single offline page verifies it from a USB stick with no network and no LeoCore account. An auditor can check the ledger without asking you, and without trusting us.
Suppliers can email documents in
Each workspace gets its own address. A supplier sends the invoice straight to it and it waits on the capture screen to be checked and sealed by a person — nothing files itself, and nothing is read by the extraction service until somebody opens it, so a mailing list costs you nothing. You choose which addresses are accepted; everything else is bounced rather than silently dropped.
Duplicates caught before the seal
The same file twice, the same vendor and date and total, or the same invoice number from the same supplier — each is caught before the record is written, while it can still be stopped. A duplicate in a ledger that cannot be edited can only be offset by a second entry, so it is checked at the one moment that is cheap.
Arithmetic that cannot be right
VAT larger than the total it belongs to, a rate no country charges, a date that has not happened yet. These are flagged for a second look and never block — the person holding the paper can always see more than the software can. Judgement calls are left to the supplier’s own history rather than to a rule about somebody else’s tax regime.
Invoices that have not arrived
A supplier who has billed monthly since January and has sent nothing for eight weeks is the one thing an archive can notice and nobody else does. It stays quiet unless there is a real rhythm to break, and it gives up on suppliers you have stopped using rather than nagging for ever.
Personal spend, kept separate
A director’s own bill is still a purchase; what is unusual is that the company should not bear it. Mark what a cost is charged to and it files under its own folder in your storage and drops out of recoverable VAT — so a return excludes it by construction rather than by somebody remembering.
Immutable by construction
Approved rows refuse UPDATE and DELETE both at the edge and via triggers inside your own database. Even someone with your database credentials cannot quietly rewrite a sealed amount.
Attribution on every row
Each record stores the signed-in identity of the person who sealed it, taken from the verified session rather than from the form. Nobody can seal a record as somebody else.
Readable object names
Files land as Year/Month/Category/Vendor_Date_Amount_CUR, so the
archive is navigable directly in your own storage — even years later, even
without this application.
Correct money, everywhere
The workspace currency sets the decimal precision from ISO 4217 and it holds through extraction, review, the filename and the ledger. Three decimals for BHD, KWD, OMR, JOD and TND; none for JPY and KRW; two for the rest. Assuming two is the most common bug in financial software, and it is not one you can fix later — sealed rows keep whatever precision they were written with.
Batch capture
Select a folder of scans and they queue. Each is extracted, shown and sealed on its own — because an immutable row nobody read is worse than no row. The queue always states what is still outstanding. A multi-page invoice goes the other way: photograph each page and they become one document, not three unrelated rows.
Auditor workstation
Split-pane grid with free-text search across vendor, notes and object key; filters by year and category; a folder view aggregating by year, month and category; totals and recoverable VAT; and CSV export.
Document inspector
Open the original image or PDF beside its ledger row, streamed through an authenticated proxy. Your bucket is never made public to render a preview.
Roles that mean something
Field captures and seals. Auditor reads only — the capture deck is removed, not merely disabled. Owner does both and administers access. An identity with no grant reaches no data at all.
Enterprise sign-in
Cloudflare Access fronts everything. Staff sign in with a one-time code sent to their work email address — no new passwords to issue or reset, and no account to create. If you run Microsoft 365 or Google Workspace we can connect it at onboarding so staff use the account they already hold instead.
Sessions that end
An idle workstation locks and signs out on a wall-clock timer that survives a sleeping phone, and the session has a hard expiry. A tablet left on a counter does not stay signed in overnight.
Multi-entity
Run several workspaces — one per company or branch — each with its own bucket, database, currency and staff list. Switching is a dropdown; crossing between them without a grant is impossible.
Records retention & compliance
Every tax authority asks the same four things.
The retention period differs by country. What the rules require of the records themselves is remarkably consistent, and it is that consistency LeoCore DMS is built against — so the same vault answers a British inspector and a Saudi one.
| What the rules require | How LeoCore DMS answers it |
|---|---|
| Keep the records for a set number of years — typically five to ten. | Records are never deleted by the application; deleting a sealed row is refused outright. Storage is your own, so no vendor retention window can expire underneath you. |
| Electronic is fine, provided it cannot be altered — the condition attached almost everywhere. | Sealed rows are immutable at two independent layers: refused at the edge, and blocked by triggers inside your own database. Each row is also hash-chained to the one before it, so alteration by anyone — including someone holding your database credentials — is detectable afterwards by an auditor running our offline verifier. Every access is recorded with the identity that made it. |
| Produce them on request, legibly and without delay. | Filter by period, category or vendor and export CSV. The images sit under readable year / month / category keys in your own storage, openable without this application. |
| Keep the supporting document, not only the book entry. | The original photograph or PDF is stored unaltered beside its index row, and the two are joined on every query. |
How long, where
A few of the regimes our customers file under. Periods run from the end of the relevant tax period, not from the invoice date.
| Jurisdiction | Retain for | Notes |
|---|---|---|
| United Kingdom — HMRC | 6 years | 10 years under VAT MOSS |
| Saudi Arabia — ZATCA | 6 years | Issued and received invoices, contracts, import and export documents |
| United Arab Emirates — FTA | 5 years | 7 years for corporate tax records |
| Bahrain — NBR | 5 years | 15 years for real estate |
| LeoCore DMS | Indefinite | Nothing expires it but you, and the storage is yours |
Retention periods are summarised from published guidance as at September 2026 and are given for orientation only. This is not tax advice — confirm your own obligations with your auditor or the relevant revenue authority.
Pricing
Per company. Not per person.
Every competitor in this category charges per seat — $50 a head at Laserfiche, $65 at M-Files — which quietly penalises you for putting the app in the hands of the storekeeper, the driver and the branch clerk. They are exactly the people who should be photographing receipts. Adding a user here is one row in a table and costs us nothing, so we do not charge for it. Add the whole branch; the price does not move.
- 1 company
- Unlimited users
- 150 sealed documents
- Full AI extraction and immutability
- Your own storage, database and AI account
- Email support
- 1 company
- Unlimited users
- Unlimited documents
- Access log and staff grant management
- Microsoft 365 / Google Workspace sign-in, on request
- Setup included on annual billing
- Support within one business day
- Up to 5 companies
- Unlimited users across all of them
- Unlimited documents
- Separate currency, storage and staff list per company
- Setup for all five included
- Priority support with a named contact
What you pay Cloudflare and Anthropic
Because the vault is in your account, those two bills are yours directly — at their published rates, with nothing added by us. They are genuinely small, and we would rather print the real numbers than say “usage-based”.
| What | Rate | In practice |
|---|---|---|
| Cloudflare R2 storage | First 10 GB free, then about $0.015 per GB per month | A sealed receipt is around 300 KB — roughly 35,000 documents before you pay anything |
| Cloudflare D1 database | Free tier covers ordinary use | Index rows are a few hundred bytes each |
| Anthropic extraction, photograph | About $0.033 per document | 200 receipts a month is about $6.60 |
| Anthropic extraction, PDF | About $0.095 per document | PDFs cost roughly 3× a photograph — worth knowing before a bulk import |
| Typical small business, 200 documents a month | — | Under $7 a month on top of your LeoCore plan |
Extraction figures measured on real retail and supplier documents in September 2026. Third-party rates are set by Cloudflare and Anthropic and may change.
What else is out there
The same archive, for a team of ten.
Published list rates as at September 2026, for ten people who need to file and find documents. We have used each vendor’s entry tier, which flatters them.
| Product | Per year, 10 users | Where the money goes |
|---|---|---|
| M-Files Essentials | ~$7,800 | $65 per seat per month |
| Laserfiche Starter | ~$6,000 | $50 per seat per month, five-seat minimum |
| DocuWare Cloud | ~$4,800–7,200 | $40–60 per seat per month once workflow and forms are added |
| Dext Business | ~$1,200+ | Strong capture, but priced per user and capped by document count |
| Zoho WorkDrive Business | ~$1,080 | $9 per seat per month — storage and sharing, no extraction, no immutability |
| LeoCore DMS Vault | $990 | Unlimited users, unlimited documents, plus around $80 a year of your own Cloudflare and Anthropic usage |
Questions
Before you ask us.
Do I need a Cloudflare account?
Yes, and that is the point — it is what makes the vault yours. A free account is enough to start; R2 object storage requires a payment method on file even inside its free tier. We walk you through creating the bucket, the database and the scoped token during onboarding, or you can follow our checklist yourself in about twenty minutes.
What happens to my documents if I stop paying?
Nothing. They are in your storage and your database, under keys you can read, in formats anyone can open. You lose the application, not the archive — which is exactly the opposite of what happens when you leave a hosted DMS. We will also hand you a plain export on the way out.
Can LeoCore see my documents?
Only if you grant us access, and you will see it if we do. Support access uses a
break-glass key that is flagged in your own access log as break-glass, with
the timestamp and the route. For most support questions we never need to open a
document at all. You can revoke our token at any moment without asking us.
How accurate is the extraction?
Good enough to save the typing, not good enough to trust unread — which is why nothing is written until a person confirms it. Low-confidence fields are highlighted rather than hidden. On clear printed receipts and supplier invoices it typically gets vendor, date and totals right, in any language and any script; faded thermal paper and handwriting are where it struggles, and it tells you so.
What if I sealed something wrong?
You post a correcting entry, the way a ledger has always worked. The original row stays, because an archive where mistakes quietly disappear is not evidence of anything. This is deliberate and it is not configurable.
Does it work offline, or on bad mobile data?
Capture and compression happen on the device, so a 4 MB photograph becomes roughly 300 KB before it is sent. You need a connection to extract and to seal. A site visit on a weak signal works; a basement with no signal does not.
What languages does it read?
The extraction model reads documents in most written languages and scripts, including Arabic, and stores them exactly as supplied. The interface is English. The amounts, dates and vendor names it returns are normalised the same way whatever the source language, so a grid filter finds them all.
Does it connect to LeoCore ERP?
Not yet, and that is the only thing here that is not finished. DMS is in production with paying customers and indexes documents in its own ledger; so is LeoCore ERP. What does not exist is the link between them — posting a sealed document straight onto a purchase invoice. Tell us if that is the thing that would decide it for you, because it moves it up.
Where is my data held?
Wherever you put it. You choose the region when you create the bucket and the database, because both are in your own Cloudflare account — Western Europe, Eastern Europe, North America East or West, or Asia-Pacific. That makes data residency your decision rather than ours, which is unusual in this category and is the whole point. If your regulator requires a country Cloudflare does not offer, tell us before onboarding and we will be straight about what is possible.
Seal your first 150 documents free.
Not a trial that expires — a working vault in your own account, which stays yours whether or not you ever pay us. We will set it up with you in about half a day.