Security and data handling

Configuration reviewed: August 30, 2026.

Where files are processed

The web application, private object storage, job metadata, queues, parser containers, and operational telemetry use Cloudflare infrastructure. The browser uploads the PDF directly to a private Cloudflare R2 bucket through a short-lived, single-object authorization; the public Next.js application does not buffer the PDF body.

The production R2 bucket and D1 database currently report the WNAM location, meaning Western North America. This is a Cloudflare location setting, not a contractual data-residency guarantee. No R2 jurisdiction restriction or Workers Regional Services policy is currently configured, so Statement2Excel.ai does not claim that every part of processing remains inside one country, state, or data center.

Encryption and access

• Browser, API, upload, callback, and download connections use HTTPS.
• Cloudflare documents that all R2 objects and their metadata are encrypted at rest using AES-256 with provider-managed keys.
• The R2 bucket is private and has no public object URL.
• Upload targets are scoped to one object and expire after five minutes.
• Workbook downloads require job authorization and use a short-lived signed target.
• Parser callbacks and runtime health routes require separate server-side secrets.

See Cloudflare's official documentation for details about R2 encryption and transport security.

Retention and deletion

Source PDFs and generated XLSX workbooks receive a deletion deadline no later than 24 hours after the upload intent is created. A maintenance Worker checks for expired objects every five minutes, deletes the source and generated artifacts, and records a deletion audit event. An independent R2 lifecycle rule provides a one-day deletion safety net for objects under the private tenant prefix.

The current MVP has no user account or delete-now dashboard control. Starting over clears the recovery record in that browser tab, but it does not immediately remove the server-side object. For an early deletion request, use the privacy contact route and provide only the opaque job identifier if available. Never attach the statement or send account details by email. The automatic 24-hour lifecycle remains the primary deletion control.

Model training and external processors

Statement2Excel.ai does not use uploaded PDFs, extracted transaction contents, or generated workbooks to train AI models. The current native-text parser is deterministic and does not send document contents to a third-party OCR service or AI model API.

Cloudflare is the infrastructure processor used for Workers, Turnstile, R2, D1, Queues, Containers, Logs, and Traces. Those services necessarily handle the request, private objects, job metadata, or operational events required for conversion. No advertising network receives bank-statement contents. Cloudflare maintains its own privacy, data-protection, and subprocessor information. If an OCR or model provider is introduced later, this page and the privacy policy must be updated before that provider receives a user document.

Logging and monitoring

Application logs are limited to operational fields such as opaque job identifiers, component versions, duration, page count, state transitions, error classes, confidence distributions, and reconciliation status. Raw PDF bytes, extracted text, user filenames, names, account numbers, transaction descriptions, signed URLs, access tokens, and credentials are prohibited from routine logs and analytics.

Document and workbook safeguards

• Declared MIME type, PDF signature, size, and document structure are validated before parsing.
• Encrypted, malformed, scanned, hybrid, and unsupported inputs return explicit failure states.
• The parser runs in a separate container boundary and receives the private object by opaque job reference.
• Queue delivery is idempotent, retries transient failures, and routes exhausted jobs to a monitored DLQ.
• Spreadsheet-formula control characters are neutralized before XLSX export.
• Balance and source-page evidence remain visible so users can review the result before relying on it.

How the current controls are evaluated

Our conversion engine is evaluated against a deterministic benchmark of 60 bank-neutral PDF fixtures covering three U.S. statement layout families, plus end-to-end staging pipeline tests for private upload, queue delivery, parsing, workbook generation, download, and job recovery.

This is a synthetic, bank-neutral benchmark statement. It does not claim validation against real customer bank statements or support for a specific financial institution.

Security limits

No system can eliminate every risk. Users must upload only documents they own or are authorized to process, review the exported workbook, and avoid using public or shared devices for sensitive conversions. Scanned, encrypted, malformed, and unsupported documents should not be converted through workarounds.

Responsible disclosure

Report a suspected vulnerability through the security contact route. Describe the issue without including a real bank statement, account number, credential, access token, signed URL, or exploit against a third-party system in the initial message.