Security & data handling
Bank statements are sensitive. This page states plainly what we do, who touches the data, and what we do not claim.
| In transit | Uploads and downloads use HTTPS (TLS). |
|---|---|
| Processing | Files are processed in memory on serverless compute (Modal) and deleted when extraction completes. We keep no permanent copy of your documents. |
| Vision check | Pages that need a second look (scans, complex layouts) are sent to the Google Gemini API. Google's API terms apply, including abuse-monitoring retention of up to 55 days. |
| Conversion history | Stored only in your own browser, not on our servers. You can delete any entry yourself. |
| Model training | We do not use your documents or outputs to train models. Google's terms govern what Google does with API data. |
| Output integrity | Every conversion is checked against the statement's opening and closing balance. If they do not reconcile, the export is flagged so you can fix the rows before importing. |
Sub-processors
- Modal Labs: serverless compute for conversion.
- Google (Gemini API): vision cross-check on routed pages.
- Cloudflare: hosting, CDN and account database.
- PayPal: payment processing. We never see card numbers.
What we do not claim
SheetParser does not currently hold a SOC 2 or ISO 27001 certification. We do not offer a guarantee that Google deletes API data sooner than its published terms. If your firm's policy forbids sending client documents to a third-party AI provider, do not upload them to the vision-checked path; contact us first.
Accounting firms and data processing agreements
If you need a written data processing agreement for your client files, email us with your firm name and we will send our DPA and sub-processor list.
[email protected]See also our Privacy Policy and Terms of Service.