How we protect your finance data

Data handling — the differentiator

Your files are processed deterministically. No language model sits in the parsing path, so your bank and invoice data is never sent to a third-party AI provider and is never used to train any model.

• No third-party AI. Parsing, validation and reconciliation are rule-based code. The same file always produces the same result — there is no model to send your data to.
• No training on your files. We do not use your uploaded content to train models, and we have no model to train it on.
• No data sale, no ad-sharing. We do not sell your personal information and do not share it for cross-context behavioral advertising.

Encryption

Access & tenancy

• Per-tenant isolation. Every record lookup is scoped to your workspace. Cross-tenant access returns an identical 404 — no record is leaked by a different response. This is exercised by the test suite.
• Password & session security. Passwords are hashed with argon2id. Sessions use HttpOnly, SameSite=Lax cookies (Secure in production) and can be revoked centrally via a session epoch, so a password reset invalidates existing sessions.
• CSRF / Origin guard. Cookie-authenticated, state-changing requests are checked against Origin/Referer, complementing SameSite.
• API keys. Stored only as hashes and compared in constant time; the plaintext key is shown once at creation.
• Admin scoping. Administrative endpoints are owner-only; there is no separate standing admin credential that survives a password change.
• Rate limits. Authentication and sensitive endpoints are rate-limited to slow brute-force and abuse.

Data integrity & verification

Because parsing is deterministic, correctness is something you can check rather than trust:

• Running-balance reconciliation. Each statement balance is checked to follow from the row before it, so a missing, altered or duplicated transaction is caught rather than passed through.
• Reproducible output hash. Every result carries a hash of its canonical output — re-run the same file and any change is visible in a diff.
• Provenance & explicit decisions. Each run records where its data came from — source file, parser, and every transformation applied — and returns an explicit accept / review / reject decision rather than a silent guess.

Infrastructure

• No open SSH. Port 22 is closed; operators reach servers only through AWS Systems Manager (SSM) session access.
• Least-privilege runtime. The application runs as a non-root, sandboxed systemd service.
• Fail-closed secrets. Production refuses to start if a required secret is missing — it never falls back to a development default. The Stripe webhook refuses to process events unless the signature verifies against the raw body.
• Hardened delivery. GitHub Actions are pinned by commit SHA, and production and staging deploys use separate roles.
• Cost & anomaly alarms. Daily spend alarms and an anomaly monitor guard against runaway usage.

Data location, retention & deletion

• Where. Data is hosted on AWS in the Tokyo region (ap-northeast-1), Japan.
• How long. Uploaded files, results and run history are retained for up to 90 days, or until you delete them or close your account — whichever is sooner. A daily retention sweep enforces this in every tenant's namespace.
• Self-service. From your account settings you can export your data and permanently delete your account and all of its data yourself; deletion takes effect immediately on our live systems, and copies in encrypted backups expire within 90 days. See the Privacy Policy for details.

Incident response

If a breach affecting your personal data occurs, we will notify affected users and the relevant supervisory authority without undue delay, as required by applicable law (including the GDPR and Japan's APPI). We do not send your file contents to logs, and we redact sensitive values from error paths.

Sub-processors

We share data only with the providers needed to run the service — AWS (hosting, Tokyo), Stripe (billing), Google (optional sign-in and marketing-page analytics). The full list, with the role and data touched for each, is on the sub-processors page.

Report a vulnerability

Compliance status — stated honestly

We do not currently hold a SOC 2 report, ISO 27001 certification, or any third-party compliance certification, and we do not claim to be "SOC 2 / GDPR / CCPA certified." A SOC 2 engagement is on our roadmap; we will begin one when a customer's security review requires it, and we are happy to complete your security questionnaire in the meantime.