Security

Hosting & location

The service runs on a dedicated KVM2 virtual server hosted in the United Kingdom (Hostinger London region). Postgres and Redis run inside the same isolated Docker network on that server and are never exposed to the public internet.

Encryption

• In transit: all traffic is HTTPS (TLS) with HSTS enabled; the app and APIs are only reachable over the encrypted connection.
• At rest: the database stores account metadata only — no file contents, no parsed transactions, no IBANs. Statement files never touch persistent storage beyond a few minutes in ephemeral memory/temporary storage.

Retention (the short version)

• Uploaded files and outputs: deleted within 10 minutes, whether or not you download.
• Parsed session for re-export: held in memory for up to 5 minutes only.
• Issue-report attachments (optional, with your consent): deleted on resolution, max 30 days.
• Account data: kept while your account exists; delete it any time via the contact form.

What we never do

• Never read, store, mine, or sell transaction data.
• No advertising trackers; analytics only load after you accept, with anonymized IPs.
• No file contents in logs, the database, or backups.

Subprocessors

Operational hardening

Backend and frontend run as unprivileged users with all Linux capabilities dropped and “no new privileges” enforced; session cookies are HttpOnly/SameSite/Secure; auth mutations are CSRF-protected; logins are rate-limited; IPs are stored only as one-way hashes; dependency vulnerability scans run clean on both Python and Node dependencies.