---
title: OmniParse AI
emoji: ""
colorFrom: teal
colorTo: orange
sdk: gradio
sdk_version: 5.49.1
app_file: server.py
pinned: false
---

# OmniParse AI — Intelligent Invoice Processing

AI-powered invoice data extraction from PDFs and images. Built with `gradio.Server` (FastAPI) backend and a custom HTML/CSS/JS frontend.

## Features

- **OCR + LLM Pipeline**: Tesseract OCR combined with Groq Llama 3.1 for 99.2% accuracy
- **Multi-format**: PDF, JPG, PNG, TIFF — 40+ formats supported
- **Duplicate Detection**: Automatic catch of duplicate payments (Pro+)
- **AI Chat Agent**: Natural language queries on your invoices (Pro+)
- **Cross-field Validation**: Automatic verification, subtotals, dates, VAT rates
- **Export**: CSV (all plans), JSON (Basic+), Excel coming soon
- **REST API**: Direct ERP integration (Pro+)
- **EU Data Storage**: GDPR-compliant, Frankfurt region

## Quick Start

Demo account: `demo@omniparse.ai` / `Demo@12345!` (Pro plan, all features unlocked)

## Architecture

```
omniparse/
├── server.py          # gradio.Server (FastAPI) — entry point
├── config.py          # Environment config & secrets
├── database.py        # SQLite + optional Supabase data layer
├── auth.py            # bcrypt auth, HttpOnly session cookies
├── ocr.py             # Multi-engine OCR pipeline
├── ai_extraction.py   # LLM extraction + server-side validation
├── middleware.py       # Rate limiting, security headers, webhook verify
├── requirements.txt   # Python dependencies
├── packages.txt       # System packages
└── static/
    ├── index.html     # SPA frontend
    ├── css/style.css  # "Midnight Teal + Copper" design system
    └── js/
        ├── app.js     # Full frontend logic
        └── icons.js   # SVG icon library (no emojis)
```

## Security

| Layer | Implementation |
|---|---|
| Passwords | bcrypt, 12 rounds + HIBP breach check |
| Sessions | HttpOnly / Secure / SameSite cookies |
| Rate Limiting | Token-bucket: 200/min global, 10/min auth, 30/min upload |
| Input Validation | Server-side only, HTML tags stripped |
| SQL | Parameterized queries, WAL mode, foreign keys |
| Files | 20 MB max, 10 files max, filename sanitization |
| Headers | HSTS, X-Frame-Options, X-XSS-Protection, CSP |
| Webhooks | Stripe signature verification |
| Row-Level Security | Via Supabase RLS when enabled |

## Environment Variables

| Variable | Required | Purpose |
|---|---|---|
| `GROQ_API_KEY` | Recommended | Groq API key for LLM extraction |
| `HF_TOKEN` | Optional | Fallback HF inference |
| `SUPABASE_URL` | Optional | Supabase project URL |
| `SUPABASE_KEY` | Optional | Supabase service key |
| `STRIPE_SECRET_KEY` | Optional | Payments via Stripe |
| `STRIPE_WEBHOOK_SECRET` | Optional | Stripe webhook verification |
| `APP_URL` | Optional | Public URL (default: localhost:7860) |

## Running Locally

```bash
pip install -r requirements.txt
sudo apt-get install -y tesseract-ocr tesseract-ocr-eng poppler-utils
python server.py
```