Security

How we protect your data

The strongest control is not holding data we do not need. No system is impenetrable, so we describe what is in place and make no promise beyond it.

In place

• Statements are not stored. The uploaded PDF is processed in memory and is never written to storage.
• PDF passwords are never stored. They are used once, in memory, to open the file.
• Reports expire. The workbook and its on-screen summary are deleted 30 days after creation.
• Strong password storage. Passwords are stored as Argon2id hashes.
• Two-factor sign-in. An authenticator-app code is required for every account on the live service.
• Account separation. Every report belongs to one account and cannot be opened from another.
• Activity record. Sign-ins, uploads, views and downloads are logged per user.
• Request protection. Anti-forgery tokens, sign-in throttling, strict browser security headers and encrypted connections (HTTPS) on the live service.
• No model training. Customer statements are never used to train models.

Not yet in place

• Independent security certification (SOC 2 or ISO 27001). We make no claim of certification.
• A completed independent penetration test.

If you find a vulnerability, please tell us through the grievance contact.