Skip to main content

Security

Bank statements are sensitive, and the product is built accordingly. This page describes practices, not certifications — where no independent certification is held, that is stated plainly rather than implied.

Protecting your data​

  • Encrypted in transit — all traffic between you and BankStmt uses TLS.
  • Encrypted at rest — stored documents are encrypted server-side, and the most sensitive fields carry a second layer of application-level AES-256-GCM encryption on top.
  • Scoped to what you may see — every request is limited to your workspace and, for firms, to the clients that person has been granted. One customer cannot reach another's information through the product.
  • Limited internal access — the people who run the service can only reach what they need to operate it, and that access is recorded.

Sign-in, keys and passwords​

  • Sign-in uses OpenID Connect through a dedicated identity service; the app never sees your password.
  • API keys are shown once and stored only as a hash. Each key carries a read or read-write scope and a per-key rate limit, and can be revoked instantly.
  • A password you supply for an encrypted PDF is used for that upload only and is never stored.

Operational safeguards​

  • An audit trail of uploads, edits, exports, approvals and sign-ins, written asynchronously to a separate audit store, so a firm can answer who did what to which client's data and when.
  • Rate limits on every surface, including a stricter limit on expensive operations.
  • Security updates applied on an ongoing basis.

Your control​

  • Export everything at any time, in open formats — see Exports.
  • Clear one statement — removes that statement's transactions and everything derived from them.
  • Clear everything — removes all accounts and all statement-derived data in the workspace. Clients, team settings, the uploaded files themselves and the audit trail are kept, so a firm can start a workspace over without losing its client list or its record of who did what.
  • Delete your account — removes your account, its data and its stored files. Deletion runs immediately; there is no waiting period.

Certifications​

BankStmt does not currently hold SOC 2, ISO 27001 or PCI DSS certification, and does not claim to. Card payments are handled entirely by a PCI-DSS-compliant payment processor, so card data never reaches our systems. For a security questionnaire, use the contact form and choose Security.

Related: Security policy · Data Processing Agreement · Sub-processors

Last updated on