Trust
Trust center
What we’ve built and you can check, what we haven’t done yet, and how the service fits your own security obligations.
Last updated , 5 min read
What’s verified today
Each control below is built into the service and covered by automated tests in our code. Where you can check it yourself, we say how.
Deletion after 24 hours by default
Uploaded statements, extracted transactions and your edits are deleted 24 hours after upload, or the moment you delete them. Signed in, you can choose to keep a batch for up to 30 days; it’s deleted on the date shown on the batch. A sweep runs every 15 minutes, and expired data is refused even before it’s swept. Storage keeps no versions and the database no point-in-time backups, so deleted data can’t be restored, by us or anyone. Every deletion leaves a receipt with dates and counts only.
How to check: A batch link stops opening once its deletion time passes. As a backstop, storage lifecycle rules delete files kept for the default after 1 day, and kept batches after 31 days. Our infrastructure tests fail if any bucket is versioned, the database has backups, or the sweep isn’t scheduled.
Encryption
Data in transit uses TLS 1.2 or later; storage refuses unencrypted connections. Files, the database, queues and logs are encrypted at rest with our own AWS KMS key, rotated automatically.
How to check: Every page sends Strict-Transport-Security (two years, preload): check the response headers in your browser’s developer tools. The at-rest settings are enforced by infrastructure tests.
Content Security Policy
Our pages may load scripts only from our own site and the services they need, and can’t be framed by other sites.
How to check: Look for the Content-Security-Policy header, including frame-ancestors 'none'.
No analytics or trackers
Our pages load no analytics, advertising or tracking scripts. Stripe’s script loads only when you open checkout; WorkOS’s sign-in page, on its own domain, runs WorkOS’s own monitoring.
How to check: Open your browser’s network panel on any of our pages: requests go only to our site and our API.
No AI training on your documents
Text recognition (Amazon Textract) and AI reading (Amazon Bedrock) run on AWS in the United States. Bedrock doesn’t use inputs for training, and our AWS organization opts out of AWS using content to improve its AI services.
How to check: Listed with every other service that touches your data on the subprocessors page.
IP addresses never stored
We never store or log your IP address. Abuse limits use a keyed hash of it that changes every day.
How to check: API access logs are configured without client addresses, and the file storage has no S3 access logging (which would record them); an infrastructure test fails otherwise.
Least-privilege access
Each part of the service gets only the AWS permissions it uses, never a wildcard on data. Statement files are parsed in an isolated process with no AWS credentials, memory and time limits.
How to check: Infrastructure tests list every permission each function may use and fail on anything extra.
Minimal data
Structured account-number fields keep only the last four digits; original statements and retained source or OCR text may contain full printed numbers until deletion. PDF passwords are used once in memory, never stored. Accounts hold your email, plan and usage; documents have separate expiry.
How to check: Described in full in the Privacy Policy.
What isn’t done yet
AnyStatement is run by one person, Ravi. Here is what a larger vendor might have that we don’t, so you can decide with the facts.
- SOC 2. Not started. We have no SOC 2 report of either type.
- ISO 27001. Not certified, and certification hasn’t started.
- Independent penetration test. None yet. No third party has tested the service; when one does, we’ll publish a summary here.
- Multi-factor authentication. Multi-factor authentication isn’t available yet. Sign-in today is email and password, or Google (where your Google account’s own two-step verification applies).
- Single sign-on, team roles and audit logs for customers. Not available. Each account belongs to one person.
- Formal security program documents. We haven’t published a written risk assessment, incident response plan or security policy set.
Vulnerability disclosure
If you find a security weakness in AnyStatement, please tell us at support@anystatement.com, with “Security” in the subject. Include what you found, the steps to reproduce it and its impact. Our contact details are also in security.txt.
Scope
anystatement.com and its API. WorkOS’s sign-in pages, Stripe’s checkout and AWS itself are out of scope: report those to their owners.
Please
- use only your own account, sessions and test files, never other people’s data;
- don’t run denial-of-service, spam or social-engineering tests, or automated scans that put load on the service;
- stop and tell us as soon as you reach data that isn’t yours, and don’t keep it;
- give us a reasonable time to fix the issue before you publish it.
Safe harbor
If you act in good faith and follow this policy, we won’t take legal action against you or ask anyone else to, and we’ll treat your research as authorized under our Terms.
What to expect
We acknowledge reports within 3 business days, keep you updated while we fix them, and credit you if you’d like. We don’t run a paid bug bounty.
FTC Safeguards Rule
Tax preparers, accountants and other financial institutions under the Gramm-Leach-Bliley Act must run an information security program under the FTC Safeguards Rule (16 CFR 314.4). Using AnyStatement doesn’t make you compliant: this table shows what we cover as your service provider and what stays with you. It isn’t legal advice.
| Requirement | What AnyStatement does | What stays with you |
|---|---|---|
| Qualified Individual, risk assessment, annual report314.4(a), (b), (i) | Not something a vendor can do for you. | Designate your own Qualified Individual and include us in your written risk assessment. |
| Access controls314.4(c)(1) | Every request is checked against the session or account that owns the batch; anything else gets “not found”. | Decide who in your firm may upload client statements, and keep exports in your own access-controlled storage. |
| Data and systems inventory314.4(c)(2) | Every service that processes your data is listed on Subprocessors. | List AnyStatement among the systems that hold customer information. |
| Encryption in transit and at rest314.4(c)(3) | TLS 1.2+ with HSTS; KMS encryption of files, database, queues and logs. | Encrypt the downloaded files and the devices that store them. |
| Secure development314.4(c)(4) | Untrusted PDFs parsed in an isolated process; automated tests for the controls on this page. | Evaluate us as an externally developed application, for example with this page. |
| Multi-factor authentication314.4(c)(5) | Multi-factor authentication isn’t available yet. | Require MFA on your own systems and email. Until we offer it, sign in with Google with two-step verification, or approve a compensating control in writing. |
| Secure disposal and data retention314.4(c)(6) | Documents and results deleted after 24 hours by default (at most 30 days for a batch you choose to keep), with no backups or versions. The one exception is a copy of a file you let us open when you report a problem: 30 days, or until you delete it. | Apply your retention policy to the exports you download. |
| Change management314.4(c)(7) | Infrastructure is defined in code (AWS CDK) and checked by automated tests. | Your own change procedures. |
| Monitoring and logging of user activity314.4(c)(8) | Service logs record IDs, sizes and errors, never content. There’s no customer-facing activity log. | Log which staff convert which clients’ statements. |
| Penetration testing and vulnerability assessments314.4(d)(2) | No third-party penetration test yet; vulnerability reports welcome (below). | Test your own systems. |
| Staff training314.4(e) | Not applicable to your staff. | Train staff not to email statements and to delete local copies. |
| Oversee service providers314.4(f) | Our Data Processing Addendum (draft) sets out our safeguards and breach notice; subprocessor changes are announced in advance. | Select us deliberately, sign the DPA, and reassess periodically. |
| Incident response plan314.4(h) | We notify affected customers of a personal-data breach within 72 hours (DPA). No written plan is published yet. | Your plan should cover an incident at a vendor like us. |
| Notify the FTC of a notification event314.4(j) | We notify you so you can meet your obligation. | Notify the FTC within 30 days when an event involves 500 or more consumers. |
IRS Publication 4557
Publication 4557, Safeguarding Taxpayer Data, is the IRS’s guide to the Safeguards Rule for tax professionals, including its “Security Six” basics.
| Requirement | What AnyStatement does | What stays with you |
|---|---|---|
| Written information security planPub 4557; template in Pub 5708 | This page, the security page and the DPA describe our safeguards for your plan. | Write and maintain your plan; name AnyStatement as a vendor in it. |
| Multi-factor authentication (Security Six)Pub 4557 | Multi-factor authentication isn’t available yet. | Use MFA everywhere it’s offered, including your Google account if you sign in with it. |
| Drive encryption and backups (Security Six)Pub 4557 | Encrypted storage; we keep nothing to back up once a batch’s deletion date passes. | Encrypt the drives that hold exports; back up your own records. |
| Anti-virus, firewall, VPN (Security Six)Pub 4557 | Applies to your devices and network, not to our service. | Run them on every device used for client work. |
| Report data theft or lossPub 4557 | We tell you about a breach affecting your data. | Report to the IRS through your Stakeholder Liaison, and to your state as required. |
Policies and documents
- Security: how your files move through the service.
- Privacy Policy and Terms of Service.
- Subprocessors: every company that processes your data.
- Data Processing Addendum (draft), for firms that need one.
- Policy change history: what changed, and when.