Encrypted at rest
Every uploaded file is encrypted with a per-workspace key and tamper-checked when read, so a file that has been altered on disk fails to open rather than returning altered data.
Deleted, not archived
Files auto-delete 24 hours after upload by default, and you can set your own retention policy per workspace. Deletion runs on a schedule rather than on request, so it is not something anyone has to remember to do.
Every action attributable
Corrections, exports and access events are recorded against the member who performed them. If a number in a client's books is ever questioned, the trail of who changed what and when exists.
Scoped access for your stack
API keys are read-only and stored as hashes rather than recoverable secrets, and webhooks are signed so your systems can verify a message actually came from us.
What we never ask for
Your clients' bank credentials. There is no bank login, no account linking, and no ongoing access to anyone's account. The tool works from the statement file you already have.
What to ask any vendor, including us
Where are files stored, and for how long? Is deletion actual deletion or archival? Is retention configurable? Who inside the vendor can read an uploaded file? Is there an audit trail you can inspect? Does the tool need bank credentials? Any vendor handling client money data should be able to answer all six without a sales call.
Common questions
- Is it safe to upload a client's bank statement?
- The risks worth weighing are retention, access and deletion. Files here are encrypted per workspace, auto-deleted after 24 hours by default, and every access is logged.
- How long are files kept?
- 24 hours by default, configurable per workspace.
- Do you need bank login credentials?
- No. Only the statement file.
- Can I get a record of who accessed a file?
- Yes — access, corrections and exports are all attributable to a member.