Security
Bank statements are sensitive, and the product is built accordingly. This page describes practices, not certifications — where no independent certification is held, that is stated plainly rather than implied.
Protecting your data
- Encrypted in transit — all traffic uses TLS.
- Encrypted at rest — stored documents and databases are encrypted, with additional application-level encryption applied to particularly sensitive fields.
- Isolation between customers — every record is bound to its owning account and that scoping is enforced on every read and write, including through the API. One customer cannot reach another's data through the product.
- Least-privilege access — internal access to production systems is restricted to what is needed to operate the service, and is logged.
Credentials and API keys
- Authentication uses standard OpenID Connect.
- API keys are stored only as hashes — the secret is shown once at creation and cannot be retrieved afterwards. Keys can be scoped read-only, given an expiry, and revoked instantly.
Operational safeguards
- Audit log of significant actions.
- Rate limiting protects both the application and the API.
- Encrypted backups, taken regularly, with restores exercised.
- Dependencies patched on an ongoing basis.
Your control
Export your data at any time in open formats, delete individual statements, or delete your account entirely — which removes your content, subject only to legally required retention and the backup cycle described in the Privacy Policy.
Certifications
BankStmt does not currently hold SOC 2, ISO 27001 or PCI DSS certification, and does not claim to. Card payments are handled entirely by a PCI-DSS-compliant payment processor, so card data never reaches our systems. For a security questionnaire, contact security@bankstmt.com.
Related: Data residency · Security policy