Supplier Portal — Connected suppliers and auto-ingest

What it is

The Supplier Portal connects NEXOS to the places your invoices already live — your supplier's email-PDF system, your inbox, and the billing tools you pay through — so invoices auto-ingest into your ledger without anyone downloading or forwarding them by hand.

Three connector types ship today: per-store email forwarding, Gmail (read-only OAuth), and direct API connectors for Stripe and AWS. Available on Professional, Business, and Enterprise plans. Configure everything in Settings → Integrations → Supplier Portal.

Email forwarding (every store, no setup)

Every store in your account gets a unique forwarding address the moment you create it. Add the address as the invoice recipient on any supplier portal that emails PDF invoices — Sysco, US Foods, Comcast, Verizon, your software vendors, your linen company, anything that sends a PDF to email. Documents extract into the right store's ledger in roughly 60 seconds.

Where to find the address

Settings → Locations → [your store] → Email forwarding address. Each store has its own address shaped like `invoices@your-store-slug.nexosscan.com` — the slug comes from the store name you set when creating the location.

How to add it on a supplier portal

1. Log in to your supplier's online portal (e.g., shop.sysco.com, your Comcast Business account, your software vendor's billing page).
2. Open the billing or notifications settings.
3. Find the field labeled "send invoices to," "billing email," "AP contact," or similar.
4. Paste your store's NEXOS address. Save.
5. Optional but recommended: keep your own AP email on the same notification list so your team still sees the invoice.

From now on, every invoice that supplier emails lands in NEXOS automatically. Multi-vendor PDFs split into separate records. Multi-page PDFs stay as one record per invoice. You'll see them appear in the Invoices queue under the right store within about a minute.

What gets pulled

• PDF invoices, statements, and bills attached to inbound emails
• Image attachments (JPG, PNG, HEIC, TIFF, WebP)
• Multi-page PDFs (combined into a single invoice record)
• Multi-vendor PDFs (auto-split into one record per vendor)

What does not get pulled

• Plain marketing emails with no attachment
• Emails to addresses other than your store's NEXOS address
• Word, Excel, and other non-document attachments

Gmail (read-only)

Connect your Gmail to let NEXOS scan your existing inbox for vendor invoices — useful when invoices already arrive in your normal email and you do not want to set up forwarding rules at every supplier.

How to connect

1. Go to Settings → Integrations → Supplier Portal.
2. Click Connect on the Gmail card.
3. Sign in to the Google account that receives your vendor invoices.
4. Review the requested scope — read-only access to messages and attachments — and approve.
5. You're returned to NEXOS and the connector starts on the next sync cycle.

What we look for

• Messages with PDF or image attachments
• Senders matching known vendor domains and patterns
• Subject lines containing terms like invoice, statement, bill, or receipt

What we do not do

• We never send email from your account
• We never delete or modify messages
• We do not read marketing email, personal email, or anything that does not match a vendor pattern
• We do not store full message bodies — only the extracted attachment and the metadata required to dedupe (sender, subject, message id)

How often we sync

Gmail polls automatically on a recurring schedule. You can also click Sync now on the connector card to pull the latest messages on demand. Disconnect at any time from the same screen — we revoke our token immediately.

Stripe (paid invoices)

If you pay vendors through Stripe — software subscriptions, contractors, anything billed via Stripe Invoicing — connect Stripe to ingest each paid invoice automatically. No more downloading PDFs from your Stripe email receipts.

How to connect

1. Open your Stripe Dashboard → Developers → API keys.
2. Click Create restricted key.
3. Give it a name like "NEXOS — invoice read."
4. Set permissions: Invoices: Read. Leave everything else as None.
5. Click Create key and copy the `rk_live_…` value.
6. In NEXOS, go to Settings → Integrations → Supplier Portal → Stripe → Connect and paste the key.

Why a restricted key (not OAuth)

Stripe's OAuth flow is built for platforms that bill on behalf of their own customers. We just need read access to your own Stripe account. Restricted keys are the right tool: scoped to one permission, revocable from your Stripe dashboard at any time, and never give us the ability to charge cards, issue refunds, or change your account.

What gets pulled

Every paid Stripe invoice since the last sync — vendor (the Stripe account name), invoice number, amount, currency, and the hosted invoice URL — gets ingested as an invoice record. The connector remembers a cursor between runs, so you never get duplicates.

How to revoke

Click Disconnect on the Stripe card in NEXOS, or roll the restricted key from your Stripe Dashboard. Either action stops all future syncs immediately.

AWS (monthly cloud bill)

If you run anything on AWS, connect Cost Explorer to ingest your monthly cloud bill as a recurring invoice. The connector reads the current month's spend and writes it into your ledger so AWS shows up alongside every other vendor.

How to connect

1. Open the AWS Console → IAM → Users → Add users.
2. Create a programmatic-access user named something like `nexos-scan-cost-explorer`.
3. Attach an inline policy granting `ce:GetCostAndUsage` (and optionally `ce:GetTags` for per-service breakdown).
4. Generate an access key. Copy the Access Key ID and Secret Access Key.
5. In NEXOS, go to Settings → Integrations → Supplier Portal → AWS → Connect and paste both values, separated by `|`, comma, or a space.

What gets pulled

Current month-to-date AWS spend, ingested as a single invoice line. The connector runs on every sync cycle and updates the running total — so by month-end you have the full bill in your ledger without ever logging in to AWS.

Permissions, scoped tight

The IAM user you create only needs `ce:GetCostAndUsage`. We cannot see your EC2 instances, your S3 buckets, your security groups, or anything else. Cost Explorer is a read-only billing API. Rotate or delete the key any time from the AWS console.

Where credentials live

All keys, OAuth tokens, and portal logins are encrypted at rest using a current industry-standard authenticated cipher before they touch the database. They are decrypted only at fetch time on the worker that's running the sync, never logged, and never exposed to the client. Disconnecting a connector clears the encrypted blob immediately.

Tier and pricing

The Supplier Portal is included on the Business plan ($99/location/month) and above. The connectors live in the same Settings panel for every plan, but you'll see a tier badge on each card so you know what's available on your subscription.

Frequently asked questions

Can I have multiple Stripe accounts connected?

Yes. Add a separate restricted key for each Stripe account — every connection runs on its own cursor and ingests its own invoices.

Does email forwarding require Gmail or any other inbox provider?

No. The store address is hosted by NEXOS. Any supplier portal that lets you set a billing email — and that includes essentially all of them — can send to it directly. You do not need to install anything in your inbox.

What happens if my Stripe restricted key or AWS access key is rotated?

The next sync cycle will fail with an authentication error and the connector card will show a red status. Reconnect with the new key — your historical invoices stay where they are.

Can I sync now instead of waiting?

Yes — every connected card has a Sync now button that runs the connector immediately and shows you the count of new items pulled.

Are you logging into supplier portals on my behalf today?

Not yet. Headless connectors for Sysco, US Foods, and Comcast are written and the encrypted credential storage is in production, but the worker fleet that actually performs the logins ships in a later phase. In the meantime, use email forwarding for those vendors — every one of them supports billing-email delivery.