The provider claims coverage of every expense report, language and country. Treat that as provider wording and confirm coverage for your languages, policy and deployment.
The provider’s own sources say different things here. Contradiction on same page: logo strip (8) vs FAQ #09 (7) – FAQ adds Coupa, omits Expensify and Oracle Fusion. No DATEV, NetSuite, Dynamics or Xero named
Sandbox: “Data and configurations cannot be copied over between the sandbox and production”; sandbox “limited to 10% of the annual production capacity”; receipt verification reads “handwritten digits on receipts (English only)”
Integration with the customer's expense management system; “Manager As An Attendee Check” requires “synchronization of the Customer employee directory”; onboarding by AppZen Professional Services
Editions Standard / Premium / Enterprise; Expenses, Cards and Invoices listed as “Volume”; Expense Audit sold as add-on; ExpertCare support at “an extra charge”
Trustworthy AI FAQ: “Any data processed by AppZen is converted into aggregated data.” Private ZenLM blog describes an isolated per-customer option (“Training data never flows back to the base model”); standard Public ZenLM uses anonymised data. No opt-out mechanism described. DPA s.8 covers de-identified data only
Certificates and audit reports
ISO/IEC 27001 certified “since 2017” (accredited body, annual); SOC 1 Type 2 and SOC 2 Type 2 attestations (CPA firm; blog page logo shows A-LIGN); PCI-DSS logo
The provider’s own sources say different things here. Provider-stated only, not registry-verified. Contradiction: Compliance Guide says ISO/IEC 27001:2013, CIO blog says ISO/IEC 27001:2022. Scope and report periods not stated. SOC 1/SOC 2 are attestations. GDPR/CCPA listed by provider are laws, not certifications
The DPA requires SOC 2 Type 2 and ISO 27001 for subprocessors and 15 days' notice of changes.
Retention and deletion
Data purged “within 90 days of the service termination”; deletion requests via Support portal confirmed “within 2 weeks”; no assurance of immediate deletion from backups. DPA s.17: delete within ninety (90) days of termination
Enterprise signals: “trusted by 1,500+ enterprises”; customers named include Databricks, Spectrum, Takeda, Bayer, Tetra Pak; deployment scoped by “number of countries deployed”
German not named explicitly; whether the UI or only receipt audit covers German not stated
Approval before posting
Partial – “High-risk items are flagged with a full explanation and routed to the right reviewer”; “Clean reports clear without human attention”; customer quote: “over 70 percent of our expense reports are auto-approved”
Human review only for exceptions; low-risk reports clear without a person. Whether reimbursement release itself is gated by the customer's expense system approval not stated
Audit trail
“Every Agent action is governed and leaves a full explanation behind, so a reviewer can see what the Agent did and why”; “complete logs of every decision the AI has made”
Retention period of AI decision logs not stated. Security events logged to Syslog servers (Compliance Guide)
Local requirements
Audit checks for VAT requirements, China fapiao, FCPA, Sunshine Act, PEP screening: “Tax rules differ by country, from VAT recovery in Europe to fapiao requirements in China”
No GoBD, XRechnung, ZUGFeRD, Peppol or SAF-T support stated for Expense Audit; separate AppZen E-Invoicing product claims to “handle tax regulations and e-invoicing mandates” without naming formats (blog einvoicing-compliance-why-finance-leaders-cant-afford-to-wait)
Questions for the provider
Ask the provider for applicable certificates and attestations, including their scope and validity.
Ask the provider for the price, billing unit and required commitment for your scope.
A written comparison of up to three AI offerings · €195 net
You get the facts that matter for your decision, each with its source, the questions to ask each vendor and a cost estimate based on your own numbers. First you agree your three most important criteria with Sten Franke.
We deliver your brief by email within a maximum of five working days after payment is confirmed and we have agreed the question and minimum information needed to begin. ETHORITY confirms the start date and delivery date and delivers earlier when the reviewed brief is ready. Missing optional information is recorded and assessed; it does not require you to research the solution yourself. Review before delivery and email support are included.
ETHORITY®