Analyze My Statement →

Legal · Beta

Security

Last updated 19 July 2026

This page describes what actually exists in the product today — not aspirational claims. We are not SOC 2, ISO 27001, or PCI-DSS certified, and we don't claim to be. If that changes, this page will say so with the date above updated.

The short version

  • • Your bank statement is parsed entirely in your browser. It is never uploaded to any server we operate.
  • • If you sign in, only the resulting analysis — not the original file — is stored, protected by row-level security so only your account can ever read it.
  • • All traffic to this site runs over HTTPS/TLS.
  • • We don't use analytics trackers or advertising pixels.

1. Where your statement is processed

PDF and CSV parsing happens with client-side JavaScript running in your browser. There is no server-side upload endpoint that receives your statement file — the file itself never leaves your device.

2. Authentication

Accounts and sign-in are handled by Supabase Auth. Your password is sent directly to Supabase over TLS and is never visible to, stored by, or logged by our own application code. Sessions are managed through secure cookies refreshed on every request.

3. Database access — Row Level Security

Saved reports live in a Postgres database (via Supabase) with Row Level Security enabled. Every read, write, and delete policy on that table is scoped to auth.uid() = user_id — enforced by the database itself, not by application logic that could contain a bug. Our application never uses a service-role or admin key that could bypass these rules; the same restricted, anon-scoped key your browser uses is all our servers use too.

4. No file storage

We don't use a file-storage bucket of any kind. Your original statement file is never stored anywhere by us, in any form — only the derived analysis (categorized transactions, totals, and the report you see) is saved, and only if you're signed in.

5. Browser-level protections

This site sends standard security headers on every response: protection against clickjacking, MIME-sniffing, and forced HTTPS on repeat visits. We keep dependencies current and monitor for known vulnerabilities in the libraries we rely on.

6. Reporting a security issue

If you believe you've found a security vulnerability, please contact us directly rather than disclosing it publicly. We'll respond and address genuine reports as quickly as we can.