Security & Data Handling

Your PDF is received over an encrypted (TLS) connection, held in memory only while we process it, and never written to disk or stored in a database. It is discarded as soon as your result is returned.

We keep summary metadata for your analysis history: bank name, the last four digits of the account, statement period, page and transaction counts, reconciliation status and timestamp.

We do not store the extracted transactions, and we never store the full account number — only its last four digits.

Data is encrypted in transit with TLS. Data at rest (your account and metadata) is encrypted by our database and hosting providers.

The uploaded PDF is sent to Mistral AI purely to perform OCR and structuring, and is not retained by us afterward. Account and metadata are held in Supabase; payments are processed by Stripe; the application is hosted on Vercel.

Row-level security ensures you can only ever see your own account and analyses. Administrative credentials are held server-side only and are never exposed to the browser.

You can delete individual analyses, close your account, or ask us to erase your data by emailing support@scanstatement.com.

If you believe you have found a security issue, please email support@scanstatement.com so we can investigate promptly.