Security & Data Handling

Bank statements are among the most sensitive documents you own. This page describes, honestly and specifically, how Statemently handles them. We avoid vague absolutes like “100% secure” — instead, here is what we actually do.

How a statement is processed

When you upload a statement, it is processed to extract transactions and then the original file’s raw bytes are discarded. We keep the structured result (transactions, balances, detected metadata, validation) and a one-way content hash used only to recognise a duplicate upload. Extraction runs on our own servers using deterministic software. If a statement is scanned or cannot be read reliably, and your plan includes advanced document recognition, images of the affected pages are sent to an external AI provider to transcribe them — see AI processing in our Privacy Policy. We do not use your statement contents to train AI models.

Password-protected PDFs

If your PDF is encrypted, we ask for the password over an encrypted (HTTPS) connection. That password is used only in memory to open the document for that single processing run. It is never written to disk, never logged, and never stored.

Data minimization

• Account numbers are masked to their last few digits; we do not store the full number.
• Original files are not retained after processing — only the extracted data and a content fingerprint.
• Operational logs are content-free. Our extraction telemetry records only aggregate counts and status (how the file was read, page count, transaction count, reconciliation outcome). It never contains a description, amount, date, reference or account number — and we never log AI prompts, page images or AI responses.

Encryption

All traffic between your browser and Statemently is encrypted in transit (TLS/HTTPS). Account passwords are stored only as salted hashes. Data at rest is stored in a managed cloud database with the provider’s encryption.

Access control

Every statement is tied to its owner. Server-side authorization checks that you can only read, export or delete statements that belong to your own account. Statements are not shared with other members of a workspace. These checks are enforced on the server, not just hidden in the interface.

Accuracy & integrity of extracted data

Financial correctness matters more than pretending every file converted perfectly. Statemently:

• Validates each statement against the accounting identity opening + credits − debits = closing and checks running-balance continuity.
• Uses the running balance, where present, to safely correct obvious errors (such as a debit/credit posted in the wrong direction) — and records every automatic change.
• Never fabricates a value it cannot determine. Anything uncertain is flagged for your review rather than guessed.
• When advanced document recognition is used, its output is treated only as a transcription. Statemently parses every amount and date itself and decides, with its own arithmetic, whether the statement reconciles — the AI never computes a total or marks a statement verified.

Payments

Card payments are handled entirely by our payment provider (Dodo Payments). Statemently never sees or stores your full card details.

Your controls

• Review and edit every extracted transaction before you rely on it.
• Delete any statement — and its data — at any time from the Statements page.
• Export your data to Excel, CSV or JSON whenever you want.

Responsible disclosure

If you believe you have found a security issue, please email security@statemently.app. We appreciate reports and will respond promptly.

No system can guarantee absolute security, but we minimize what we hold, protect what we keep, and are transparent about both.