LeoCore DMS · Sovereign document vault
Every document sealed. In your account, not ours.
Photograph a bill on your phone. It reads itself — vendor, date, total, VAT. You check the fields and seal it. The image lands in your cloud storage and the index row in your database, under a token you issue and can revoke in one click. Once sealed, every edit to the row is refused — ours included — and any change made behind the application’s back is detectable.
~5 seconds from photo to reviewed fields Unlimited users on every paid plan Zero client documents on LeoCore infrastructure
The problem
A shoebox of receipts is not an archive. Nor is a shared drive.
Nobody can prove it wasn’t changed
A PDF on a network drive can be replaced at any time and the file date rewritten. Tax authorities permit electronic records on the condition that they cannot be altered — a folder cannot meet that on its own, whichever revenue service is asking.
Keying it in twice, badly
Somebody reads the total off the paper and types it into the accounts. Software that assumes two decimal places turns 84.735 into 84.74, and 1,200 yen into 1,200.00 — nobody notices until a reconciliation fails.
You cannot see who looked
Ordinary document systems record who may open a folder. Almost none record who actually did — least of all when the vendor’s own support team opens it.
How it works
Four steps, and one of them is irreversible on purpose.
Capture
On a phone, the app opens the rear camera directly. The image is downscaled and compressed on the device before it goes anywhere, so a site visit over mobile data is not a problem. A scanner mode finds the page in the viewfinder, fires the shutter once the picture stops moving, and squares up a document photographed at an angle so the small print reads straight. Crop, straighten and rotate run against the full-resolution original, never the compressed copy. PDFs are accepted and stored unaltered so their text layer survives, and structured e-invoices are accepted as the XML the supplier issued. On a PC, select a stack of files at once — they queue up and you work through them one at a time.
Extract
The document is read automatically and comes back with vendor, document date, VAT, total, the bill number, the supplier’s bank account, a category and a confidence rating, in seconds. The call is made with your Anthropic key, so the document reaches your account and LeoCore appears in neither the content nor the billing record. If extraction is unavailable the operator keys the fields by hand and nothing stops.
Verify
Nothing is written until a person confirms it. Low-confidence fields are
highlighted. The date is typed in a fixed DD-MM-YYYY order rather
than picked from a browser calendar — a native picker paints its value in
the browser’s locale, so the same receipt reads 09/07 on a phone and
07/09 on a desk, and the row cannot be edited afterwards. Amounts follow the
workspace currency, from its ISO 4217 minor unit — the dinars carry three
decimals, the yen none, most of the world two. Sealing is a press-and-hold, never a
tap, and the bar shows the amount and the name about to go on the row. Lose the
signal at this point and the reviewed document waits on the device, plainly
marked as not yet in the vault, and seals itself when the connection returns.
Seal
The image is written to your storage under a readable key
— 2026/09/Expense_Bill/BATELCO_2026-09-11_84.735_BHD —
and the index row to your database, stamped with the signed-in identity of
whoever sealed it. From that moment the row is immutable: update and delete
are refused at the edge and by triggers inside your own database.
A correction is posted as a new entry, the way a ledger has always worked.
What makes this different
We built a door. The vault is yours.
Every other document system in this market asks you to upload your records to the vendor’s cloud and then trust their policy. LeoCore DMS inverts that. Your documents are written to storage you own, in an account you control, and we reach it per-request with a scoped token you issued.
Your storage
Document images go to object storage in your own Cloudflare account. Not a folder inside ours. The bucket is never public; images are streamed back through an authenticated proxy.
Your database
Index rows — vendor, date, amounts, the file reference — go to a database in your account. LeoCore’s own database holds connection profiles and access grants only. Never a document, a vendor name, or an amount.
Your AI account
Extraction runs on your Anthropic key, billed to you at cost. There is no platform key and no fallback: your documents never travel through a LeoCore credential, and we never mark up a token. A workspace owner installs or replaces the key from the workspace settings — it is checked before it is saved and only its last four characters are ever shown again — and every read shows the tokens it used.
Your off switch
Access is a scoped token you create yourself, carrying edit rights to the storage and database services this application uses and nothing else in your account — no domains, no DNS, no billing, no other service. Revoking it in your own dashboard severs LeoCore’s access immediately and completely. You do not need to ask us, and we cannot stop you.
Your audit of us
A workspace owner can open the access log and see every request made against their vault, who made it, and when — including any use of LeoCore’s break-glass support key, which is flagged as such. A sovereignty claim nobody can check is a marketing line; this one is a table in your own console.
Features
Built for the person holding the paper, and the person auditing it.
One deployment, two shapes: a one-handed capture utility on a phone, and a widescreen split-pane workstation for whoever has to find things later.
AI field extraction
Vendor, document date, the bill or invoice number as printed, VAT, total, currency, the supplier’s bank account, category and sub-category, with a confidence rating that flags what needs a second look. Works on photographs and on PDFs. Arabic numerals are read as numbers, and where a document prints both a Gregorian and a Hijri date the Gregorian one is taken.
Tamper-evident, and checkable without us
Every sealed row is hashed together with the hash of the row before it, so altering any record breaks every link after it. The whole chain exports with the arithmetic printed alongside, and a single offline page verifies it from a USB stick with no network and no LeoCore account. An auditor can check the ledger without asking you, and without trusting us.
Suppliers can email documents in
Each workspace on a paid plan gets its own address. A supplier sends the invoice straight to it and it waits on the capture screen to be checked and sealed by a person — nothing files itself, and nothing is read by the extraction service until somebody opens it, so a mailing list costs you nothing. You choose which addresses are accepted, and mail that fails its own domain’s sender authentication is refused even from an accepted address. Everything refused is bounced rather than silently dropped.
Duplicates caught before the seal
The same file twice, the same vendor and date and total, or the same invoice number from the same supplier — each is caught before the record is written, while it can still be stopped. An identical file needs an explicit override; the others are flagged for a person to decide. A duplicate in a ledger that cannot be edited can only be offset by a second entry, so it is checked at the one moment that is cheap.
Arithmetic that cannot be right
VAT larger than the total it belongs to, a rate no country charges, a date that has not happened yet. These are flagged for a second look and never block — the person holding the paper can always see more than the software can. Judgement calls are left to the supplier’s own history rather than to a rule about somebody else’s tax regime.
Invoices that have not arrived
A supplier who has billed monthly since January and has sent nothing for eight weeks is the one thing an archive can notice and nobody else does. It stays quiet unless there is a real rhythm to break, and it gives up on suppliers you have stopped using rather than nagging for ever.
Personal spend, kept separate
A director’s own bill is still a purchase; what is unusual is that the company should not bear it. Mark what a cost is charged to and it files under its own folder in your storage and drops out of recoverable VAT — so a return excludes it by construction rather than by somebody remembering.
Immutable by construction
Approved rows refuse UPDATE and DELETE both at the edge and via triggers inside your own database. Even someone with your database credentials cannot quietly rewrite a sealed amount. An auditor can fire a real edit at any sealed row and watch it refused — and the attempt is recorded under their name.
Attribution on every row
Each record stores the signed-in identity of the person who sealed it, taken from the verified session rather than from the form, and how the document came in — scanner, camera, upload, multi-page or email. Nobody can seal a record as somebody else.
Readable object names
Files land as Year/Month/Category/Vendor_Date_Amount_CUR, so the
archive is navigable directly in your own storage — even years later, even
without this application.
Correct money, everywhere
The workspace currency sets the decimal precision from ISO 4217 and it holds through extraction, review, the filename and the ledger. Three decimals for BHD, KWD, OMR, JOD and TND; none for JPY and KRW; two for the rest. Assuming two is the most common bug in financial software, and it is not one you can fix later — sealed rows keep whatever precision they were written with. A foreign-currency invoice keeps its own currency and decimals, is never silently converted, and is kept out of home-currency totals.
Batch capture
Select a stack of scans and they queue. Each is extracted, shown and sealed on its own — because an immutable row nobody read is worse than no row. The queue always states what is still outstanding. A multi-page invoice goes the other way: photograph each page and they become one document, not three unrelated rows.
Auditor workstation
Split-pane grid with free-text search across vendor, bill number, notes and object key; filters by year and category; a folder view aggregating by year, month and category; recoverable VAT by month, quarter or year; supplier aliases that group different spellings without touching a sealed row; and CSV export. On a phone the grid becomes cards.
Document inspector
Open the original image, PDF or e-invoice beside its ledger row, streamed through an authenticated proxy. Your bucket is never made public to render a preview.
Roles that mean something
Field captures and seals, and sees only what they sealed. Auditor reads only — the capture deck is removed, not merely disabled. Owner does both and administers access. An identity with no grant reaches no data at all.
Enterprise sign-in
Single sign-on fronts everything. Staff sign in with a one-time code sent to their work email address — no new passwords to issue or reset, and no account to create. If you run Microsoft 365 or Google Workspace we can connect it at onboarding so staff use the account they already hold instead.
Sessions that end
An idle workstation signs out after 15 minutes, on a wall-clock timer that survives a sleeping phone, and the session has a hard expiry. A tablet left on a counter does not stay signed in overnight.
Multi-entity
Run several workspaces — one per company or branch — each with its own bucket, database, currency and staff list. Switching is a dropdown; crossing between them without a grant is impossible.
E-invoices, filed as issued
A UBL e-invoice — Peppol BIS, PINT AE, ZATCA — is read field by field from the file itself, not interpreted by a model, so it costs no AI usage and files even in a workspace with no AI key. The XML the supplier issued is what gets sealed, because that is what a tax authority asks for.
A supplier’s bank details that change
A real invoice arriving with somebody else’s account on it is the costliest fraud in accounts payable. The account is recorded as printed and hashed into the chain, and when a supplier with a history asks to be paid somewhere new you are told — and told to confirm it on a number you already had. Spacing and a supplier’s second account do not set it off.
Retention dates and legal holds
Set your retention period in years and every record shows the date it may be disposed of, counted from the document date. A legal hold must state a reason, and who placed and lifted it is kept. The application deletes nothing on the strength of either — the date informs, it never acts.
Records retention & compliance
Every tax authority asks the same four things.
The retention period differs by country. What the rules require of the records themselves is remarkably consistent, and it is that consistency LeoCore DMS is built against — so the same vault answers a British inspector and a Saudi one.
| What the rules require | How LeoCore DMS answers it |
|---|---|
| Keep the records for a set number of years — typically five to ten. | Records are never deleted by the application; deleting a sealed row is refused outright. Set your period and each record shows the date it may be disposed of; a legal hold, with its reason, keeps it past that date. Storage is your own, so no vendor retention window can expire underneath you. |
| Electronic is fine, provided it cannot be altered — the condition attached almost everywhere. | Sealed rows are immutable at two independent layers: refused at the edge, and blocked by triggers inside your own database. Each row is also hash-chained to the one before it, so alteration by anyone — including someone holding your database credentials — is detectable afterwards by an auditor running our offline verifier. Every access is recorded with the identity that made it. |
| Produce them on request, legibly and without delay. | Filter by period, category or vendor and export CSV. The images sit under readable year / month / category keys in your own storage, openable without this application. |
| Keep the supporting document, not only the book entry. | The original photograph or PDF is stored unaltered beside its index row, and the two are joined on every query. |
How long, where
A few of the regimes our customers file under. Periods run from the end of the relevant tax period, not from the invoice date.
| Jurisdiction | Retain for | Notes |
|---|---|---|
| United Kingdom — HMRC | 6 years | 10 years under VAT MOSS |
| Saudi Arabia — ZATCA | 6 years | Issued and received invoices, contracts, import and export documents |
| United Arab Emirates — FTA | 5 years | 7 years for corporate tax records |
| Bahrain — NBR | 5 years | 15 years for real estate |
| LeoCore DMS | Indefinite | Nothing expires it but you, and the storage is yours |
Retention periods are summarised from published guidance as at September 2026 and are given for orientation only. This is not tax advice — confirm your own obligations with your auditor or the relevant revenue authority.
Pricing
Per company. Not per person.
Every competitor in this category charges per seat — around $50 a head at Laserfiche and $65 at M-Files, by third-party listings — which quietly penalises you for putting the app in the hands of the storekeeper, the driver and the branch clerk. They are exactly the people who should be photographing receipts. Adding a user here is one row in a table and costs us nothing, so we do not charge for it. Add the whole branch; the price does not move.
- 1 company
- Unlimited users
- Unlimited documents
- Full AI extraction and immutability
- Your own storage, database and AI account
- Access log
- Email support
- You provision it yourself — setup is not included
- No email-in address
We don’t limit the free plan by counting what is in your vault, because we can’t see what is in your vault.
Start free- 1 company
- Unlimited users
- Unlimited documents
- Email-in address for supplier documents
- Access log and staff grant management
- Microsoft 365 / Google Workspace sign-in, on request
- Setup included on annual billing
- Support within one business day
- Up to 5 companies
- Unlimited users across all of them
- Unlimited documents
- Separate currency, storage and staff list per company
- Setup for the first company included on annual billing, $190 for each additional
- Priority support with a named contact
What you pay your own providers
Because the vault and the extraction account are yours, those bills come to you directly at their published rates, with nothing added by us. They are genuinely small: a business filing around 200 documents a month typically pays under $7 a month on top of its LeoCore plan, and storage for the first several tens of thousands of documents usually falls inside a free tier. We go through the current rates with you before you commit, so the number is one you have seen rather than one you have been promised.
What else is out there
The same archive, for a team of ten.
Third-party list rates, September 2026, for a business with ten people who need to file and find documents. Vendors price on different bases, so each figure says what it is for. M-Files, Laserfiche and DocuWare publish no price of their own; the figures below are the ones reported for their entry tiers, and where sources disagree we have used the lower one, which flatters them.
| Product | Per year | Where the money goes |
|---|---|---|
| M-Files Essentials | ~$7,80010 users | $65 per seat per month |
| Laserfiche Starter | ~$6,00010 users | $50 per seat per month, five-seat minimum |
| DocuWare Cloud | ~$4,800–7,20010 users | $40–60 per seat per month once workflow and forms are added |
| Dext | —no sourced total | 250 documents a month and 5 users included; priced per user above that. Strong capture, capped by document count |
| AutoEntry | ~$1,176200 docs/mo | Credit-based: about $44 a month for 200 credits, $98 for 500. A line-item invoice costs 2 credits, so 200 a month needs 400 — the 500-credit plan |
| Zoho WorkDrive Business | ~$1,08010 users | $9 per seat per month — storage and sharing, no extraction, no immutability |
| Hubdoc | ~$144flat, per business | About $12 a month standalone, and free with eligible Xero subscriptions. Capture and a feed to your books — no immutable record, and your documents held on its servers |
| LeoCore DMS Vault | $990unlimited users and documents | Unlimited users, unlimited documents, plus around $80 a year of your own storage and extraction usage |
Dext, Hubdoc and AutoEntry do a different job: they read a receipt and push the figures into Xero, QuickBooks or Sage. LeoCore DMS has no accounting integration at all — not with those, and not yet with LeoCore ERP. It is the sealed archive, not the bookkeeping feed, and some customers will reasonably run both.
Questions
Before you ask us.
Do I need a Cloudflare account?
Yes, and that is the point — it is what makes the vault yours. A free account is enough to start, though object storage asks for a payment method on file even inside its free tier. We walk you through creating the storage, the database and the scoped token during onboarding, or you can follow our checklist yourself in about twenty minutes.
What happens to my documents if I stop paying?
Nothing. They are in your storage and your database, under keys you can read, in formats anyone can open. You lose the application, not the archive — which is exactly the opposite of what happens when you leave a hosted DMS. We will also hand you a plain export on the way out.
Can LeoCore see my documents?
Only if you grant us access, and you will see it if we do. Support access uses a
break-glass key that is flagged in your own access log as break-glass, with
the timestamp and the route. For most support questions we never need to open a
document at all. You can revoke our token at any moment without asking us.
How accurate is the extraction?
Good enough to save the typing, not good enough to trust unread — which is why nothing is written until a person confirms it. Low-confidence fields are highlighted rather than hidden. On clear printed receipts and supplier invoices it typically gets vendor, date and totals right, in any language and any script; faded thermal paper and handwriting are where it struggles, and it tells you so.
What if I sealed something wrong?
You post a correcting entry, the way a ledger has always worked, and the two are linked to each other in both directions. The original row stays, because an archive where mistakes quietly disappear is not evidence of anything. This is deliberate and it is not configurable.
Does it work offline, or on bad mobile data?
Capture and compression happen on the device, so only a fraction of the original photograph is ever sent. Reading a document needs a connection; without one you key the fields yourself. A document you have reviewed but cannot seal waits on the device, marked as not yet in the vault, and seals in order once the signal returns.
What languages does it read?
The extraction model reads documents in most written languages and scripts, including Arabic. Vendor names are stored exactly as printed — on a bilingual document, the Latin trading name. Amounts and dates are normalised whatever the script: Arabic numerals are read as numbers, and the Gregorian date is taken where a Hijri one sits beside it. A date printed only in the Hijri calendar is left for a person to enter. The interface is English.
Does it connect to LeoCore ERP?
Not yet, and that is the only thing here that is not finished. DMS is in production with paying customers and indexes documents in its own ledger; so is LeoCore ERP. What does not exist is the link between them — posting a sealed document straight onto a purchase invoice. Tell us if that is the thing that would decide it for you, because it moves it up.
Where is my data held?
Wherever you put it. You choose the region when you create the bucket and the database, because both are in your own Cloudflare account — Western Europe, Eastern Europe, North America East or West, or Asia-Pacific. That makes data residency your decision rather than ours, which is unusual in this category and is the whole point. If your regulator requires a country Cloudflare does not offer, tell us before onboarding and we will be straight about what is possible.
Start free. No document limit.
Not a trial that expires — a working vault in your own account, which stays yours whether or not you ever pay us. On the free plan you provision it yourself; on an annual paid plan we set it up with you, typically in half a day.