Security

Your statement is read by your browser

When you drop a PDF, the converter — JavaScript that your browser downloaded with the page — opens it, reads the text and builds the table. For most statements the file is not uploaded at all, and nothing is stored when you close the tab. The Excel or CSV file is created in your browser too, and saved straight to your downloads.

Two cases go to our server. First, a statement your browser could not read, or whose balances do not add up, is read again on our server automatically, and you see it happen. Second, scanned statements and photos, if you choose it. You can read them on this device (your browser downloads the open-source Tesseract engine from the jsDelivr CDN and nothing is sent), or on our server, which uses better recognition models. On our server the file is kept in a private folder that only the reading process can open, read by a background worker, and deleted as soon as it has been read; the recognised text is encrypted and deleted when your browser collects it, or after 30 minutes at the latest.

Enforced by the browser, not only promised

Every page is served with a Content Security Policy, a header that tells your browser which servers the page may talk to. Ours allows only this site and jsDelivr (for the OCR engine). Even if a script tried to send your statement elsewhere, the browser would block it. This is the policy, as sent:

default-src 'self'; script-src 'self' 'unsafe-inline' 'wasm-unsafe-eval' blob: https://cdn.jsdelivr.net; worker-src 'self' blob: https://cdn.jsdelivr.net; connect-src 'self' blob: data: https://cdn.jsdelivr.net; img-src 'self' data: blob:; style-src 'self' 'unsafe-inline'; font-src 'self' data:; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; object-src 'none'

The site is HTTPS only (HSTS), cannot be embedded in other sites, and asks for no camera, microphone or location access.

Check it yourself in one minute

1. Open this site, then turn off Wi-Fi or unplug the network.
2. Drop a statement PDF. It still converts, and you can still download the Excel file — because nothing needed to leave your device.

Or open your browser's developer tools (F12), go to the Network tab and convert a statement: you will see the page's own files and small /api/event counters, and no request carrying your file.

What does reach our server

• Anonymous usage counters — for example “a statement was converted, 3 pages, 42 rows, balances matched, Excel downloaded”. No names, numbers, amounts, dates, descriptions or file names. Visitors are counted with a hash that changes every day, without cookies.
• Statements your browser could not read, and scans or photos you choose to read on our server — deleted after reading, except a statement we still cannot read (next item).
• Statements we still cannot read — the original file, encrypted with AES-256 with a key only our server holds, and an anonymous copy of its layout. Opened only by our team to add support for the layout, every access logged, and deleted once the layout is supported, after 14 days at most.
• Messages you send through the contact form, and a statement only if you choose to attach one there (deleted after 30 days).

Full details are in the privacy policy.

Report a vulnerability

Please email [email protected]. We reply within two working days and credit researchers who want to be credited. See also security.txt.