Security

1. Your browser requests an upload slot and receives a short-lived signed URL with a size limit.
2. The PDF is sent over TLS directly to private storage under a random object key. The original filename is kept as metadata only.
3. The document is inspected (page count, text or image, encryption) and, on your instruction, converted by a worker process that reads it from storage.
4. Transactions, validation results and exports are written to the database and to storage, scoped to your organisation.
5. Originals are deleted 24 hours after processing; exports and extracted transactions 7 days after conversion; Delete now removes everything immediately. A scheduled sweeper verifies that deletions happened.

Transport

TLS for every request, including uploads and downloads. HTTP Strict Transport Security is enabled in production.

Storage

Private buckets or disks; no public objects. Every read and write goes through a short-lived signed URL. Object keys are random and never derived from your data.

Account numbers

Stored masked (last digits only). Full numbers are not retained after extraction.

Passwords for encrypted PDFs

Held encrypted with an application-level key (AES-GCM, rotatable) only while the conversion runs, then deleted. Never logged.

Logs

Structured logs contain ids, counts, versions and durations. Descriptions, amounts, account numbers, passwords, cookies and tokens are redacted at the logger.

Authorisation

Every conversion, upload and export is checked against the requesting organisation on every request. Public ids are random and non-sequential.

Application security

Content Security Policy and related headers, secure same-site cookies, CSRF protection on state-changing requests, rate limiting on uploads and authentication, and an audit log of sensitive actions.

Uploads

Files are checked for PDF structure, size and page limits, and guarded against decompression bombs before processing. Filenames are never trusted.

OCR and AI

OCR runs on our own infrastructure. The optional AI step is off unless stated on the subprocessors page, is limited to ambiguous column mapping using a redacted sample, and never trains models.

Payments

Card details are handled by Stripe; we never see or store card numbers.

Uploads by visitors without an account

Deleted after 60 minutes if not converted.

Original PDFs

Deleted 24 hours after processing completes (configurable per deployment).

Exports

Deleted 7 days after conversion.

Extracted transactions

Deleted 7 days after conversion (with the exports); optionally 10 minutes after your first download with the Purge on download setting. Technical metadata (bank, page count, confidence, dates) stays in your history until you delete the conversion.

Delete now

Purges the original, extracted data and exports immediately; the purge is verified by a sweeper.

We do not currently hold SOC 2, ISO 27001 or similar certifications and do not describe the service as bank-grade or 100% secure. If a certification is obtained it will be listed here with its scope and date.

Email [email protected] with steps to reproduce. Please do not access other users' data while testing. We acknowledge reports and keep reporters informed of the fix.