Is it safe to upload a bank statement online?
It can be, if you know where the file goes and when it is gone. At BankConv your PDF travels over TLS 1.2 and 1.3, is read only to extract the transactions, and is deleted with its converted files 24 hours later. BankConv never connects to your bank. Below is the full path a statement takes.
What to check before uploading anywhere
A bank statement can’t be used to sign in to your bank or move money: it has no password, PIN or card security code. It does hold your name, address, account number and a record of your spending, so treat it like any document you would hand to an accountant.
Before uploading a statement to any converter, BankConv included, check that the service:
- Uses HTTPS for uploads and downloads (look for the padlock).
- Deletes files on a stated schedule, not “when no longer needed”.
- Works from the PDF, without asking for your online banking login.
- Says who else processes the file.
- Lets you delete a file before the schedule runs out.
- Doesn’t train AI models on what you upload.
The rest of this page answers those questions for BankConv.
The life of an uploaded statement
Upload
Your PDF travels to BankConv over HTTPS (TLS). The connection uses TLS 1.2 and 1.3.
Opening the file
If the PDF is password-protected, you type the password in the browser so the file can be opened.
Extraction
The pages are sent to a document processing provider, which reads them (with OCR for scanned statements) and returns the tables. BankConv turns those tables into transaction rows.
Preview and export
You see the rows, then download Excel or CSV, or send them to Google Sheets. Downloads also travel over HTTPS.
After 24 hours
The uploaded PDF and its converted files are deleted automatically, or after 48 or 72 hours if your team chose a longer window.
Rather not share the password of a protected PDF? Open it, print it to a new PDF (most PDF viewers allow this), and upload the copy, which has no password.
Who can see your statement
- You and your team. Conversions belong to a team, and other customers can’t open them. API keys only reach their own team’s conversions.
- The document processing provider. It receives the pages to read the tables and returns the result to BankConv.
- Service providers that don’t receive the statement file: Stripe for payments, an email provider, error monitoring and Cloudflare. The full list is in the privacy policy.
BankConv does not sell your data, does not show ads, and does not use the contents of your statements to train machine learning models.
Compared with the alternatives
The usual alternatives are copying rows by hand, or pasting the statement into a general AI chat. Each has its own trade-off.
| Question | Copying by hand | General AI chat | BankConv |
|---|---|---|---|
| Where the statement goes | Stays on your computer | The chat service’s servers, as part of your chat history | BankConv and its document processing provider |
| How long it is kept | Until you delete it | Usually until you delete the chat; it depends on the service and your settings | Files deleted after 24 hours (48 or 72 if your team chose) |
| Used to train AI models | No | Depends on the service, your plan and your settings | No |
| Risk of wrong numbers | Typos and skipped rows | Rows can be skipped, merged or made up | Extraction errors are possible, so compare the totals with the statement |
Your account and payments
- Two-factor authentication. Turn it on under Settings → Two-factor authentication, with any authenticator app. You get recovery codes in case you lose the phone.
- Team roles. Only team owners and admins can change the retention window or manage API keys.
- API keys. Each key belongs to one team and can be revoked from the team settings at any time. Requests are limited to 60 a minute per key. See the API docs.
- Payments. Checkout runs on Stripe’s own payment page, so your card number goes to Stripe and never reaches BankConv’s servers.
Deleting your data
- Automatically: files are deleted after 24 hours, or 48 or 72 if your team chose. Owners and admins set this in the team settings.
- Through the API:
DELETE /api/v1/conversions/{id}removes a conversion’s files straight away. - By email: write to support@bankconv.com from your account email to delete a conversion, or to have your account and everything linked to it erased.
Reporting a security issue
If you think you have found a vulnerability, email support@bankconv.com with “Security” in the subject. Include the steps to reproduce it and what you think the impact is.
Please test only against your own account, don’t open or change other people’s data, don’t run load or denial-of-service tests, and give us a reasonable time to fix the issue before you make it public. The same contact is published in security.txt.
Questions
Is it safe to upload a bank statement to BankConv?
Your statement travels over TLS 1.2 and 1.3, is read only to extract its transactions, and the PDF and converted files are deleted after 24 hours by default. BankConv never asks for your bank login. As with any online service, you are trusting the people who run it, so this page says exactly who handles the file and what is kept.
Can someone get into my bank account with my statement?
A statement does not contain your online banking password or card PIN, so it cannot be used to sign in to your bank. It does contain your name, address, account number and spending, which is why it should only go to services that say how they handle and delete it.
How long do you keep my statement?
The PDF and its converted files are deleted automatically after 24 hours. Team owners and admins can choose 48 or 72 hours instead.
Who can see my statement?
You and the members of your team. The document processing provider reads it to extract the tables.
Do you use my statements to train AI models?
No. BankConv does not use the contents of your statements to train machine learning models, and does not sell your data.
Can I delete a statement before the retention window ends?
Yes. With the API, DELETE /api/v1/conversions/{id} removes the files straight away. From the dashboard, email support@bankconv.com with the file name and we will delete it.
Do I need to connect my bank account?
No. BankConv works from the PDF you download from your bank. It never connects to your bank and never asks for your online banking login.
Questions about your data
Email support@bankconv.com with any question about a file you uploaded or how it is processed. The legal details are in the privacy policy and terms.