Question 1

What is the NEXOS Scan Supplier Portal?

Accepted Answer

The Supplier Portal connects NEXOS Scan to the places your invoices already live so they auto-ingest into your ledger. Three connector types ship today: per-store email forwarding (every store gets a unique address shaped like invoices@your-store-slug.nexosscan.com), Gmail read-only OAuth, and direct API connectors for Stripe (paid invoices) and AWS (monthly Cost Explorer bill). Available on Professional, Business, and Enterprise plans.

Question 2

How does per-store email forwarding work?

Accepted Answer

Every store you create in NEXOS Scan automatically gets a unique forwarding address like invoices@your-store-slug.nexosscan.com. Add it as the billing email on any supplier portal that emails PDF invoices — Sysco, US Foods, Comcast, your software vendors. Invoices land in the right store's ledger in roughly 60 seconds. Multi-vendor PDFs auto-split into separate records.

Question 3

What scope does the Gmail connector use?

Accepted Answer

Read-only. NEXOS Scan requests gmail.readonly so it can scan messages and pull PDF or image attachments matching known vendor patterns. We never send mail, never delete or modify messages, and only store extracted attachments plus the metadata required to dedupe. Disconnect any time and we revoke the token immediately.

Question 4

How do I connect Stripe to NEXOS Scan?

Accepted Answer

Open Stripe Dashboard → Developers → API keys → Create restricted key. Set permissions to Invoices: Read, leave everything else as None. Copy the rk_live_… value and paste it into Settings → Integrations → Supplier Portal → Stripe in NEXOS Scan. We use a restricted key instead of OAuth because Stripe's OAuth flow is for platforms billing on behalf of others; a restricted key is the right scope for read-only access to your own account.

Question 5

How do I connect AWS to NEXOS Scan?

Accepted Answer

Create an IAM user in AWS with a single permission: ce:GetCostAndUsage (and optionally ce:GetTags). Generate an access key and paste the Access Key ID and Secret Access Key into Settings → Integrations → Supplier Portal → AWS. NEXOS Scan ingests your month-to-date AWS bill as a single recurring invoice line and updates it on every sync. The IAM user cannot see EC2, S3, or any non-billing resource.

Question 6

Where are supplier credentials stored?

Accepted Answer

API keys, OAuth tokens, and portal logins are encrypted at rest with AES-256-GCM before they touch the database. They are decrypted only at fetch time on the worker running the sync, never logged, and never sent to the client. Disconnecting a connector clears the encrypted blob immediately.