Home › Security
Security
CSVLedger parses, reconciles and exports bank statements with JavaScript in your browser, so the PDF is not transmitted to any server. There are no accounts and no stored history; the only third-party script is cookieless Cloudflare Web Analytics, and a Content-Security-Policy blocks scripts from anywhere else.
Updated October 29, 2026
The safest place for a bank statement is the computer it is already on. CSVLedger is built so that the statement never needs to leave it.
Where your data goes
| Data | Where it is processed | Stored? |
|---|---|---|
| Statement PDF | In your browser (pdf.js, running locally) | No — gone when you close the tab |
| Extracted transactions and exports | In your browser | Only the files you choose to download |
| PDF password (for protected files) | In your browser, passed to pdf.js | No |
| Pages converted today | Your browser's localStorage | Yes, a single number and a date, on your device |
| Waitlist email (only if you submit it) | Our server | Yes, to tell you when paid plans or OCR launch |
| Standard request data (IP address, user agent) | Cloudflare, our host, when serving pages | As described in Cloudflare's policies |
How to verify it yourself
- Open your browser's developer tools and select the Network tab.
- Convert a statement.
- You will see the page's own files load (scripts, styles, pdf.js) and one small Cloudflare Web Analytics page-view beacon, but no request that carries your PDF or the transactions.
You can also load the page, disconnect from the internet, and convert a file — it still works, because nothing needs a server.
Security headers
Every response includes a strict Content-Security-Policy (scripts only from this domain plus the Cloudflare Web Analytics beacon; no other third-party connections), X-Content-Type-Options: nosniff, a frame-ancestors restriction against click-jacking, a strict referrer policy and HSTS.
What we do not claim
CSVLedger is a new, small service. We do not hold SOC 2 or ISO 27001 certifications. The design goal is to make such certifications unnecessary for the converter itself, because statement data never reaches us. If your firm requires a certified vendor for document processing, that is a valid reason to choose a certified service.
Frequently asked questions
Can CSVLedger staff see my statements?
No. The files are never sent to us, so there is nothing to see.
Is it safe to use on a shared computer?
Nothing is saved except a page counter. Downloaded files go to your Downloads folder like any other download, so delete them on shared machines.
Do you use my data to train AI models?
No. We never receive the data. The converter uses rule-based parsing, not an AI model.
How do I know the conversion is correct?
Every conversion is checked against the statement itself: the opening balance plus credits minus debits must equal the closing balance printed on the statement, to the cent. If the statement prints a running balance, each row is checked too, and rows that do not match are highlighted in red. If the check fails you see it before you download anything.