Security & Data Handling
A bank statement is a sensitive document. Here is exactly what happens to every PDF you upload — no storage, no model training, automatic deletion.
Auto-deleted within 14 days
Uploaded PDFs are deleted from our servers automatically and permanently within 14 days at the latest — the same window as result verification and error reports (refunds).
Unknown formats are held briefly
A layout the system does not yet recognize is held temporarily on the server for automatic format learning; these PDFs are also permanently deleted within 14 days at the latest.
Never used to train models
Your statement content is never added to any AI model's training data. The only thing learned is the column layout (a template) — not your transaction amounts, names, or balances.
Encryption end to end
All traffic is protected with strong, industry-standard encryption. Temporary PDF storage uses encrypted disk space. Passwords are stored only as irreversible hashes; plaintext passwords are never kept anywhere.
Scoped authentication
API access uses per-account keys you can revoke at any time from the dashboard, or short-lived session tokens. Your sessions are protected with secure browser cookies.
No third-party data sharing
All processing, including OCR, runs locally on our own servers. Your PDF content is never sent to any external service (cloud OCR, LLM APIs, etc.). Payment data lives only with Paddle, not with us.
Retention periods
Your part
- Keep your API keys secret; if one leaks, revoke it instantly from the dashboard and generate a new one.
- Your webhook URL must be a public HTTPS address (SSRF protection) — internal addresses are rejected.
- If you use the demo on a shared machine, close the browser tab when you are done.