[ security ]
Your statements stay yours
Bank statements show where you live, what you earn and how you spend. We designed the product to keep as little as possible, for as short as possible.
Uploaded files are never stored
Your PDF, photo or export is read in memory on our server and discarded as soon as the transactions are extracted. We don't keep a copy, and there is no file storage bucket to leak.
Only the transactions are kept — and only for you
Extracted transactions are stored in your account so you can review and export them. Nobody else can access them. You can delete any statement instantly, set automatic deletion, or delete your whole account.
Encrypted in transit and at rest
All traffic uses HTTPS (TLS). Our database (Supabase, PostgreSQL) encrypts data at rest. Access to production data is limited to the service itself.
No bank logins
We never ask for online banking credentials and never connect to your bank. You decide exactly which documents we see.
AI that doesn't learn from you
PDFs and photos are read by Anthropic's Claude models through their commercial API. Under Anthropic's commercial terms your data is not used to train models; it may be retained by Anthropic for a limited period for abuse monitoring and is then deleted.
Hardened by default
Strict content security policy, httpOnly session cookies, cross-site request protection, rate limits, file-type checks by content (not file name), and spreadsheet-formula neutralisation in CSV exports.
Payments handled by Paddle
Card details go straight to Paddle and never touch our servers. Paddle is our merchant of record and handles tax compliance.
Found a security issue? Email support@bankstatementcategorizer.com and we'll respond within two business days.
Your next statement takes seconds.
See what we find on your statement before you pay.