Outside calls | Nuits Receipts

Nuits Receipts runs in your own Cloudflare account. Nuits never sees your data. The app has no telemetry, analytics, update check, licence server or sign-up. With AI_MODE=mock it makes no AI or FX calls at all.

The table lists every call the Worker makes. Calls to your own D1 database and R2 bucket are bindings in your account and are not listed.

Recipient	Endpoint	When	What is sent	What comes back
Cloudflare Workers AI, Clairic	`@cf/cloudflare/clairic` via the `AI` binding	Each time a document is read, including Read again and Read it. Not for mail held as `sender_unverified`.	The document text (up to 40,000 characters, including the forwarding email’s text), the image for photos, the list of fields to read, and the date the document was received.	Field values with confidence and `p_null`.
Cloudflare Workers AI, Clairic	`@cf/cloudflare/clairic` via the `AI` binding	On import of a PDF bank statement whose layout is not built in (Holvi PDFs make no call). One request per 20 payments, up to 4 at a time.	The text of each payment block of the statement (up to 800 characters each), with page headers and footers left out, and the list of fields to read.	Each field’s value with confidence and `p_null`.
Cloudflare Workers AI, Clef	`@cf/cloudflare/clef` via the `AI` binding	After reading an expense receipt when no vendor rule matches. Not for sales invoices.	Seller name, line item descriptions, the document text and email context, your product ids and labels, and the four expense types.	A product and an expense type, with probabilities.
Cloudflare Workers AI, Clef	`@cf/cloudflare/clef` via the `AI` binding	At most once per bank import, only for payments of that file that no receipt fits, no rule marks, and that read like a bank transfer to a person. At most 40 payments.	For each payment, the merchant name and up to 120 characters of its reference text, and the question whether it is a purchase. No amounts, no account details.	For each payment, purchase or not a purchase, with probabilities. Only a choice at or above `REVIEW_MIN_CATEGORY_CONFIDENCE` is used.
Frankfurter	`https://api.frankfurter.dev/v2/rates`	When a non-EUR document with a total and issue date has no cached rate for that currency and date.	Currency code, `EUR`, provider `ecb`, and a date range from 6 days before the issue date to the issue date. No document content.	ECB reference rates. Cached in `fx_rates`. Timeout 10 seconds.
Cloudflare Access	`https://<ACCESS_TEAM_DOMAIN>/cdn-cgi/access/certs`	Access mode only, when no cached key matches the token. Keys are cached for one hour per isolate.	Nothing beyond the request.	The team’s public signing keys.
Microsoft identity platform	`https://login.microsoftonline.com/common/oauth2/v2.0/token`	Only after you press Connect in Settings > OneDrive: once to finish sign-in, then whenever an upload needs a fresh access token.	Client ID, client secret, the sign-in code with its PKCE verifier, or the stored refresh token, and the scopes `offline_access Files.ReadWrite.All User.Read`.	Access and refresh tokens.
Microsoft Graph	`https://graph.microsoft.com/v1.0`	After connecting: to read your name and email (`/me`), resolve the folder link (`/shares/...`, `/me/drive/sharedWithMe`), and upload a month.	The folder link you paste, folder names, the month’s original files and index spreadsheets.	Drive item IDs and upload results.
Cloudflare Email Routing	`message.forward()`	When `FORWARD_COPY_TO` is set, for every incoming message.	The incoming message, unchanged, to that one address.

Clairic is a Cloudflare preview model, so its availability, behaviour and price may change.

The browser loads only resources from the app’s own origin: self-hosted fonts at /assets/fonts/ and the upload script at /assets/add.js. The page Content Security Policy allows no other origins.

Not called

Never contacted	Note
Nuits	No request goes to any Nuits server.
Banks	Bank data comes only from CSV files you upload.
Microsoft, before you connect	With OneDrive off or not connected, no request goes to Microsoft. Disconnect deletes the stored sign-in and upload records.
Any service, for the month ZIP	Building the ZIP reads only R2 and D1.

Logs

Workers observability is on in wrangler.jsonc with head_sampling_rate 1 (every request). Logs stay in your Cloudflare account. The app writes short reason codes to the log, never document content:

Code	Meaning
`email_too_large`	An incoming email was over 20 MiB and was dropped.
`sender_auth_failed`	A sender failed SPF or DMARC, and the mail was dropped. Logged with the sender’s domain when the sender is not approved.
`sender_unverified`	Mail from a sender who is not approved could not be proven, and was dropped. Logged with the domain only.
`sender_not_allowed`	Mail from a sender who is not approved was kept and shown as New sender in Receipts To do. Logged with the domain only.
`sender_ignored`	Mail from an ignored sender was not kept. Logged with the domain only.
`duplicate`	A waiting email from a new sender with the same Message-ID was already kept or read.
`held_limit`	Too many emails from new senders were waiting, so this one was not kept.
`mail_log_failed`	The mail log row could not be written. Mail handling was not affected.
`forward_copy_failed`	Forwarding to `FORWARD_COPY_TO` failed. Reading was not affected.
`forward_copy_loop`	`FORWARD_COPY_TO` equals a receiving address, so no copy was sent.
`forward_copy_invalid`	`FORWARD_COPY_TO` is not a valid address, so no copy was sent.
`settings_unavailable`	The `settings` table could not be read; Worker vars were used.