Where your statement goes
You are about to upload a document with your account number and every transaction you made last month. This page is the whole path, step by step, with every company that touches it named or described.
Last updated September 20, 2026
The data flow, step by step
- You pick a file. It is still on your device. On a phone, photos are shrunk in your browser before upload.
- Upload. The file travels over TLS to our edge worker on Cloudflare and is held in the memory of that one request. It is never written to disk, never queued and never copied into a bucket or a database.
- Pages are prepared. For a native PDF, the text layer is read. For a scan or photo, the page image is prepared for the reader.
- Extraction. Page contents are sent over TLS to Anthropic's commercial API, where its Claude model reads the printed table and returns structured rows. Anthropic's commercial terms prohibit training on our data, and it deletes inputs within 30 days.
- The balance check runs. Entirely on our side. No external service sees the result.
- Exports are built. A review workbook (XLSX) is generated from the extracted rows. When you upload it back after checking it, Excel (XLSX), CSV, CSV for import, QuickBooks (QBO), OFX, Quicken (QFX) and QIF files are generated from its rows on request. Neither the workbook nor the files are stored.
- The result is sent to you. You review it and download the formats you need.
- Deletion. When the request ends, the file, the page images and the extracted transactions go with it. A conversion takes minutes at most, and nothing survives an hour under any circumstance. What remains is one usage record: page count, native or scanned, the upload's size, whether the check passed or which fixed reason refused it, and the cost. No file name, no account number, no transaction text. Visits are counted without cookies: the page path, the referring site's hostname, a campaign tag when the link carries one, country, network number, device class, browser family, and a daily visitor key, a one-way hash of the IP address and browser string with a random value that is deleted when the day ends. The address itself is never stored. If you arrived by clicking one of our advertisements on Google Search, the click id from that link is stored against the same daily key for 90 days, so that a purchase can be matched to the advertisement that led to it. The privacy policy lists every field.
If you close the tab mid-conversion, the same thing is left behind: a counter. The download you already have is the only lasting copy of a conversion, which is why the result is worth saving before you leave the page.
How the file is protected
- All traffic is encrypted with TLS, both between you and us and between us and every provider below.
- Statement contents are never written to logs, not in errors, not in debug output. Logs record page counts and error types.
- The file lives in the memory of one request. There is no bucket, no queue and no database row that holds it.
- Access to production infrastructure requires two-factor authentication and is limited to the operator.
- Secrets are held in the platform's encrypted secret store, never in source code, and the repository is scanned for secret patterns before every release.
- Sign-in uses a single-use code sent to your email address, so there is no password database. The code is stored as a keyed hash, expires in ten minutes, and the attempt counter rises before the comparison so parallel guessing cannot outrun the limit.
- Session cookies carry 32 random bytes and the database holds only a hash of the token, so a copy of the database cannot be turned into a session.
- Uploads are identified by file signature rather than by the name or content type the browser claims, and size and page limits apply before any expensive work starts.
- Exported spreadsheets are sanitized against formula injection, so a transaction description crafted to execute in Excel cannot.
- Payment runs on Polar's checkout. Card numbers never reach our systems.
The five companies that receive anything
Four of them touch a statement or an account. The fifth touches neither, and is here because it is the only third party whose code runs on these pages.
| Who | Role | What they get |
|---|---|---|
| Cloudflare, Inc. (United States) | Hosting, TLS, bot protection, email routing | Network traffic and the file while the request that converts it is running. No copy afterwards. |
| Anthropic, PBC (United States) | Claude, the model that reads the statement | The page contents, during extraction. Bound by a DPA and standard contractual clauses; no training on our data; deletes inputs within 30 days, except a request its safety systems flag. |
| Polar Software Inc. (United States) | Merchant of record: checkout, invoicing, tax | Your email, billing country and payment details. Card numbers never reach us. |
| Resend, Inc. (United States) | Outbound email: sign-in codes, receipts, support replies | Your email address and the message we send you. |
| Google Ireland Ltd and Google LLC (Ireland and the United States) | Advertising measurement, for visitors in the United States and Canada only | The page you are on and the fact that a purchase happened, so Google can tell us whether an advertisement we paid for led to a sale. Never a statement, an email address or an account. Its tag is not sent to a visitor anywhere else, or to a browser sending Global Privacy Control or Do Not Track. |
That is the complete list. There is no analytics provider, no session-recording tool, no CRM and no data broker, and no company on it receives a statement except the two that have to.
Anthropic publishes its own security certifications at trust.anthropic.com, and its data retention and training commitments for API customers at privacy.claude.com.
The paperwork your firm needs
If your practice cannot upload a client's statement without a written processor agreement, it is already written and on this site. Our data processing agreement takes effect when you use the service and needs no signature, so you can file it today and start work.
It sets out the subject matter and duration, the categories of personal data and data subjects, confidentiality, the security measures on this page in contractual form, the sub-processor list with 30 days' notice before it changes, the transfer safeguards, our assistance with data subject requests, breach notification within 48 hours, audit and information rights, and what happens to data at the end.
For a countersigned copy on letterhead, a completed security questionnaire, or the sub-processors named individually, write to support@statementtable.com and you will have it back the same business day.
Cookies
What is stored depends on where you are. There is no third-party analytics script here, no session recording and no cross-site tracker. There is one advertising cookie, and only for visitors in the United States and Canada, which are the two countries we advertise in. Everywhere else the tag that would set it is never sent, so there is nothing to consent to and still no cookie banner.
Three things can be stored in your browser, and that is the complete list:
__Host-st_session, ours: an opaque,HttpOnly,Securesession cookie set only if you sign in, so you stay signed in for 30 days or until you sign out. Use the free tier without signing in and it is never set.- Cloudflare's challenge cookies, on the converter and the sign-in page: we use Turnstile there to tell a person from a script, and when it has to show you a challenge, Cloudflare stores a short-lived value, about an hour, so you are not asked again on the next page. It carries nothing that identifies you to us, and we cannot read it.
_gcl_au, Google's advertising cookie, for visitors in the United States and Canada: a first party cookie, set on our own domain, lasting about 90 days. It carries an identifier for the ad click that brought you here, so that Google can tell us that someone who clicked one of our advertisements later paid. The tag sends the address of the page you are on and, at the end of a checkout, that a purchase happened and what it was worth. It does not read what is on the page, nothing from your statement, your account or your payment goes into it, and we do not read the cookie. We run no remarketing and no audience targeting.
The first two are strictly necessary for the part of the service you asked for, which is why neither needs your consent. The third is not strictly necessary, so it is not set where consent would be required: a request that reaches us from the EEA, the United Kingdom or Switzerland is served the page without the tag. A browser sending Global Privacy Control or Do Not Track never receives the tag either, wherever it is. Nothing of ours is stored in your browser beyond the first two: no local storage, no session storage. We read no canvas, font, screen or hardware details to recognise a device; the only thing derived from a request is the daily visitor key above, and its random ingredient is deleted each day. The legal detail is in the privacy policy.
Reporting a vulnerability
Email support@statementtable.com with "security" in the subject line. The same address is published at /.well-known/security.txt. We reply within one business day, we will not take legal action against good-faith research, and we will tell you what we fixed and when. If you would like public credit, say so and you get it. Incidents affecting account holders are announced by email to those affected.
Retention periods, deletion, account closure and your rights under the GDPR, the UK GDPR and KVKK are set out in the privacy policy. That policy is the binding document; this page is the plain-language companion to it.
Convert one and see
During the launch offer ten pages a day are free, and you don't need an account to run your own statement through it.