How it works under the hood
ClearStatement is a static website. There is no application server in the path of your document. When you open a statement, the PDF is read by a PDF-parsing library running inside your own browser tab. Dates, descriptions and amounts are identified locally, in memory, and the spreadsheet is generated on your own machine. No copy of your file is ever sent across the network.
Because there is no upload step, there is nothing for us to store, lose, or hand over. The only server-side code in the entire product is a small function that accepts an email address for the optional Pro waitlist — and it never receives a document.
The practical consequences:
- Parsed in your browser. Your PDF is processed by JavaScript on your device, not on a server.
- Never uploaded. There is no upload endpoint for your file to be sent to.
- No backend storage. We have no database of statements, because we never receive one.
- Close the tab and it's gone. Nothing about your statement is written to disk or persisted anywhere.
ClearStatement vs traditional online converters
Most online converters work the same way: you upload your statement, their server processes it, and they delete it after some window of hours. That is not necessarily careless — but "we delete it after a few hours" still means your statement sat on someone else's server, where it could be accessed, misconfigured, or breached during that window. ClearStatement removes the window entirely by never taking the file.
| ClearStatement | Typical online converter | |
|---|---|---|
| Where your PDF goes | Stays on your device | Uploaded to their server |
| Who can read it | Only you | The vendor and their staff |
| How long it is kept | Not at all — it never leaves | Usually deleted after 1–24 hours |
| Works with no internet | Yes, once the page has loaded | No |
| Account or email required | No | Often yes |
| Could it leak or be sold | Cannot — we never have your file | Depends on their security and policy |
What we collect (and what we don't)
We use Google Analytics 4 to understand anonymous, aggregate usage — things like page views and which pages people visit. GA4 never receives your file name, your transaction amounts, or any content from your statement. The conversion itself is not reported to Google.
The optional Pro waitlist form asks for one thing: your email address. Nothing else. We don't ask for your name, your company, or your statement. Like any web request, our host records standard technical data — including the IP address that submitted the form — and we use it only to prevent spam and abuse.
What we don't claim
We are an independent project, and we would rather be accurate than impressive. ClearStatement does not hold SOC 2, ISO 27001, or any other formal security certification, and we will not imply that we do. We don't have an enterprise security team or a bug-bounty program, and you won't find a compliance badge on this page.
What we can promise is structural: the safest way to protect a document is to never collect it in the first place. That is how ClearStatement is built, and it is a stronger guarantee than a certificate.