Security and data handling

Three commitments

These are the commitments statement.work makes about your statements. This page explains each one and what it means in practice. It deliberately doesn't claim more than that.

1. Encrypted in transit and at rest

Statements are encrypted while they travel from your browser to statement.work and while they are stored, from the moment you upload through processing. "In transit" covers the network connection; "at rest" covers the stored file. Both matter: encryption in transit stops someone reading the file on the way, and encryption at rest protects it where it is kept.

2. Deleted after processing

Source files are removed once your export is ready, on a retention window you control. The original statement is the most sensitive thing you upload: it shows the full account picture, often with names, addresses and account numbers. Keeping it no longer than needed reduces what could ever be exposed.

3. Never used to train models

Your financial data stays yours. It isn't used to train or fine-tune any model. Uploading a client's statement to get a spreadsheet back doesn't turn their transactions into training material.

What you control

• What you upload. Convert only the statements you need. If a task only needs one month, don't upload the year.
• How long source files are kept. The retention window for source files is yours to set.
• Where the export goes. Once you download a CSV, Excel or JSON file, it lives on your systems under your own controls. Treat it as carefully as the statement itself.

Good practice on your side

Security is shared. A few habits keep statement data safe before and after it reaches statement.work:

1. Get statements from the source. Download PDFs from online banking, or ask clients to use a secure file-sharing method rather than plain email attachments.
2. Store exports in access-controlled folders, not shared drives anyone can open.
3. Name files consistently (client, account, period) so nothing gets sent to the wrong person.
4. Delete local copies you no longer need, including the downloads folder.
5. Use strong, unique passwords and multi-factor authentication on the accounts where statements live.

Our guide Is it safe to upload bank statements online? includes a checklist for evaluating any tool that handles financial documents, including this one.

Questions for a security review

If your firm runs a formal review before using a new tool, it will probably ask about hosting, sub-processors, access controls and certifications. This page only states what statement.work commits to today. Raise anything else you need when you join early access, before you upload client data.