Is it safe to upload bank statements to an online converter? 8 questions to ask

What a bank statement reveals

A single statement usually carries the account holder’s name and address, the bank, part or all of the account number, the statement period, opening and closing balances and every transaction in that period. The transactions show who pays the account holder, including salary, and who they pay: landlords, doctors, schools, subscriptions and other banks. A business statement shows suppliers, customers and payroll.

The FTC lists bank account numbers among the details identity thieves use, and tells consumers to keep financial records in a safe place and shred them before throwing them away. A statement uploaded to a website deserves the same care as one on your desk: you should know where it is stored, who can read it and when it is destroyed.

Questions to ask any converter

These eight questions cover the points where statement data can leak or linger. The table on this page explains why each one matters and what a good answer looks like, with Fulla Ledger’s answers alongside. Ask them of every converter you consider, including free ones and including Fulla.

• How long do you keep the PDF, the extracted rows and the exported files?
• What happens if a scheduled deletion fails?
• Which AI services or other companies receive the statement pages?
• Do those services keep the pages or use them for anything else?
• Can your staff open my statement, and is that access recorded?
• Which certifications or audit reports can you show me?
• Can I delete a statement before the retention period ends?
• Where is all of this written down?

What the FTC and CISA advise

The FTC’s guide for businesses, Protecting Personal Information, rests on five principles: take stock of the personal information you hold, scale down to what you need, lock it, pitch what you no longer need, and plan ahead for security incidents. On outside vendors it is direct. Before outsourcing data processing, investigate the company’s data security practices and compare their standards to yours, put your security expectations in writing in contracts, verify compliance rather than taking the vendor’s word for it, and insist that service providers tell you about security incidents. The same guide notes that laws such as the Gramm-Leach-Bliley Act and the FTC Act may require reasonable security for sensitive information.

For individuals, the FTC’s page on identity theft advises checking bank statements for withdrawals you did not make and keeping financial documents in a safe place. Before giving out a Social Security number, it suggests asking why the organization needs it and how it will protect it. Those two questions are worth asking of any service that wants your bank statements.

CISA’s tip sheet Safeguarding Your Data, which CISA now keeps in its archive, covers your side of the upload: keep software up to date, encrypt sensitive files, follow your employer’s policies for handling work data, and dispose of sensitive files properly, because deleting a file does not always erase it. Apply that to the statement you download as well as the one you upload.

Client data: what to get in writing

If you handle statements for clients, a converter becomes one of your service providers. Following the FTC’s advice, get the answers in writing, either in the vendor’s published privacy notice or in a signed agreement, and keep a dated copy with your client file.

• The retention period, and whether it covers extracted data and exports as well as the uploaded PDF.
• The named companies that process statement content, and what each one does.
• Whether uploaded statements are used to train or improve models, by the vendor or by its providers.
• Who on the vendor’s staff can open a statement, under what conditions, and whether that access is logged.
• How and how quickly the vendor will tell you about a security incident.
• What happens to your data if you close your account or stop paying.

What Fulla Ledger does not have

Fulla Ledger does not publish a SOC 2 report. If your firm requires a SOC 2 report from every vendor that handles client data, Fulla does not meet that requirement. Some converters do publish one; when a vendor says it has a report, ask to see the report itself and the period it covers, not a badge.

Removing a statement before the 24-hour deadline needs a signed-in workspace owner. A page converted without an account cannot be removed early; it is deleted when its 24 hours end.

Fulla’s answers on this page come from its own Privacy notice and product policies. They describe how the service is designed to work. They are not an independent audit.

How Fulla handles a statement, step by step

This is what happens to a statement you upload to Fulla Ledger, from upload to deletion.

• You upload a PDF: text, scanned, mixed or password-protected, up to 50 MiB and 250 pages per file and up to 10 files at once. The 24-hour clock starts when the upload starts.
• Fulla stores the PDF in private encrypted storage and renders its pages for extraction.
• Rendered pages go only to the AI extraction service named in the Privacy notice: Mistral, through OpenRouter, with zero data retention. No other AI service receives statement pages.
• You review the drafted rows beside the source page, correct anything that is wrong and approve. Nothing is exported until you approve.
• You download Excel, CSV or OFX from the website, or JSON through the API.
• Support can open the statement only if you ask and give explicit consent. That access ends when the statement expires, and every access is logged.
• A workspace owner can remove the statement earlier. Removal deletes the PDF, extracted data and exports.
• 24 hours after the upload started, the PDF, extracted rows and exports are deleted. If a deletion fails, access is blocked straight away and the deletion is retried.
• Account, workspace and billing records are not statement content. The Privacy notice lists them and the rules that apply to them.