How StmtPilot approaches data protection, access control, and vulnerability reporting
2026/03/29
StmtPilot is designed for sensitive bank statement conversion workflows. This page describes the security practices we currently use to protect uploaded files, extracted rows, exports, and supporting systems.
We aim to keep the product simple, short-lived, and tightly scoped:
We use reasonable technical and organizational safeguards intended to protect statement conversion data in transit and at rest. This may include encrypted transport, managed infrastructure controls, short-lived session access, and internal access restrictions.
Access to production systems and statement-related data is limited to the extent reasonably necessary to operate, maintain, and secure the service. We use account-based access controls and attempt to limit privileged access to authorized personnel and service providers.
StmtPilot relies on short retention windows as part of its security model:
Current operational retention defaults are described in our Privacy Policy.
Security also depends on how you use the service. You are responsible for:
If you believe you have discovered a security issue affecting StmtPilot, please contact us with enough detail for us to investigate. Please do not access data that does not belong to you, disrupt the service, or publicly disclose unresolved issues before we have had a reasonable opportunity to respond.
No service can guarantee absolute security. While we work to protect StmtPilot and the data processed through it, you acknowledge that all internet services carry some residual risk.
We may update this Security Policy as the product, infrastructure, or security practices evolve.