Security

Bank PDF Converter implements security controls aligned with SOC 2 Trust Services Criteria. Our infrastructure providers (Cloudflare and Convex) are SOC 2 Type 2 certified. Formal SOC 2 certification for Bank PDF Converter is on our roadmap.

The short version: Your bank statements are encrypted in transit and at rest, automatically deleted based on your chosen retention period (default: 3 days), and processed securely on enterprise-grade infrastructure.

Infrastructure

We run on Cloudflare and Convex, both of which hold SOC 2 Type 2 certifications. This means independent auditors have verified their security controls meet rigorous standards for protecting customer data.

All data is processed and stored in the United States. Our infrastructure includes:

• DDoS protection at the network level via Cloudflare
• Physical security controls and 24/7 monitoring at data centers
• Redundant systems for availability

Data Protection

Encryption

All connections to Bank PDF Converter use HTTPS with TLS encryption. We do not support unencrypted HTTP connections.

Data at rest—including your uploaded bank statements and converted files—is encrypted using AES-256 encryption.

Automatic Deletion

Your files are automatically deleted after your chosen retention period. The default is 3 days, but you can configure this anywhere from 1 to 180 days in your dashboard settings.

You can also delete any file manually at any time from your dashboard—no waiting required.

What We Don't Do

• We don't sell your data
• We don't share your data with third parties for marketing

For full details, see our Privacy Policy.

Application Security

Authentication

We use secure, OAuth-based authentication. Sessions are managed with HTTP-only cookies that cannot be accessed by client-side scripts.

Access Controls

Every request to access your data requires authentication. Users can only see and download their own files. There are no shared accounts or team features that could inadvertently expose your data to others.

Rate Limiting

API endpoints are rate-limited to prevent abuse and protect against denial-of-service attacks.

Input Validation

All form inputs are validated and sanitized. State-changing operations include CSRF protection to prevent cross-site request forgery.

Payments

We never see or store your credit card information. All payment processing is handled by Polar, which is powered by Stripe. Stripe is PCI-DSS Level 1 certified—the highest level of certification in the payments industry.

Incident Response

If we ever discover a security incident that affects your data, we will:

1. Investigate and contain the issue as quickly as possible
2. Notify affected users and relevant authorities as required by law
3. Provide clear guidance on any steps you should take

Reporting Security Issues

Please reach out via our support chat and we'll work to address it.

Questions?

If you have questions about our security practices, contact us.