Your clients’ statements are not ours to keep.

Your statements are deleted when the run ends

Uploaded PDFs exist on our servers only while they are being read. The moment a run finishes – successfully or not – they are deleted. The PDFs are never written to our database, so they never appear in a backup.

Data retention is off unless you turn it on

With retention off, no run logs are written and your finished workbook is deleted within an hour of your first download. Turning retention on takes an explicit confirmation, so it cannot happen by accident, and the setting is recorded on each run at the moment it starts – changing it later cannot retroactively alter a finished accounting.

The one-hour window is deliberate rather than instant. Deleting the workbook the moment the download begins reads as maximally private and behaves as data loss: a dropped connection, a browser that blocks the save, or simply wanting the CSV as well as the Excel file all came back to find nothing.

No consumer AI tool ever sees your documents

Extraction runs on Amazon Bedrock. Under AWS’s terms, document content is not stored after a request completes and is not used to train any model. We additionally keep Bedrock’s optional request logging switched off – and our software checks this at startup and refuses to run if logging is enabled, or if it cannot confirm that it is off.

That last clause is the part that matters. “We could not check” is not the same as “it is off”, and treating it as such would defeat the guarantee entirely.

What the database actually holds

The PDFs never reach it. Three things derived from them do, and each has a defined life:

• Your finished workbook. Stored so you can download it. With retention off it is deleted within an hour of your first download – an hour rather than instantly, so a dropped connection or wanting the CSV as well does not cost you the run.
• The extracted figures, while a run is in progress or paused waiting for you to name a recurring payment. This is what lets a paused run be resumed, and a finished one be rebuilt without re-reading a page. With retention off it is deleted when the run finishes.
• The forensic report, if you asked for one. It names payees and amounts, so it is treated exactly like the workbook and is deleted with it.
• Run logs, only ever for accounts with retention switched on, kept 30 days.

With retention off, a completed and downloaded run leaves nothing behind but the page count we billed you for.

Encrypted in transit and at rest

Every upload, download and API call travels over TLS 1.2 or better – the same industry-standard encryption banks use. At rest, our database and its backups are encrypted with AES-256.

What leaves our servers

We would rather state this plainly than imply nothing ever does:

• Statement page images go to Amazon Bedrock, under the terms above, in US regions.
• Security names (for example “ISHARES CORE MSCI EAFE ETF”) are looked up against a public market-data source to resolve them to a clean name. No account numbers, balances, names or amounts are ever sent, and the lookup can be disabled entirely.

Nothing else. No analytics vendor, no advertising network, and no third-party processor sees a client document.

Account protection

Passwords are hashed with bcrypt. Sign-in is rate limited per account and per source address. Every run is scoped to the account that created it, checked on the server rather than hidden in the interface.