AES-256 at rest
The database, uploaded files, and backups are encrypted with AES-256. Someone holding a copy of the disk sees ciphertext.
How StatementsReady protects your statement.
StatementsReady keeps your personal financial statement in an encrypted database on AWS, connects to your banks read-only through Plaid, and lets you export or delete everything from your own settings page. This page lists what we can see, what we cannot, and how each piece is protected.
7 days freeNo credit card required
Encrypted before
it is stored.
Your statement lives in an encrypted database, and the fields a thief would want most carry a second lock of their own.
A second lock on sensitive fields
Social Security numbers, account numbers, bank tokens, and two-factor backup codes are each encrypted again inside the record with AES-256-GCM. A database export alone shows nothing useful.
TLS in transit
Every request runs over HTTPS. Browsers are told to refuse plain HTTP for a full year, so a downgrade attempt fails.
Keys that rotate
Each encrypted field records which key version sealed it, so keys can be rotated in the background without you re-entering anything.
Read-only,
through Plaid.
You sign in at your bank inside Plaid's window. Plaid hands us a token. Your password never reaches our servers.
What we see
Account names, account types, and current balances. For credit cards, mortgages, and loans, the balance owed. For brokerage accounts, the current value.
What we never see
Your bank password or your transactions. We do not ask Plaid for transaction data, and the connection has no way to move money.
Disconnect any time
Remove a bank from settings and the token is revoked at Plaid. Trial connections are removed 25 days after the trial ends.
One door for every bank
Chase, Bank of America, Wells Fargo, and the rest of Plaid's 12,000+ financial institutions connect through the same Plaid window, so the rules above hold for all of them.
Your login,
your rules.
Passwords are hashed with bcrypt. Everything else here is a switch you control from settings.
Two-factor sign-in
Turn on 2FA with an authenticator app or by SMS. You get backup codes for a lost phone, stored hashed the same way passwords are.
An email on every sign-in
Each successful login can send you an email with the time, device, and IP address. Turn it off in settings if you would rather not.
See every signed-in device
Settings lists every active session. Sign one out, or all of them, in a click.
Short-lived sessions
Access tokens expire after 30 minutes and renew for up to 7 days. Both live in HTTP-only cookies, which page scripts cannot read.
Only who you choose,
only as long as you say.
A lender gets a link, and the link is the only way in. It needs no account, and it stops working when you decide.
Links that expire
Pick the expiry when you create the link. Download links default to 30 days and signing requests to 7.
Revoke in one click
Revoke a link and it stops working immediately, even if the lender already opened it once.
See who opened it
Every link counts views and downloads and shows when it was last opened, so you know whether the underwriter has looked.
Signing with recorded consent
Co-signers sign on a link of their own. Their consent to sign electronically is recorded before the signature is.
Hosted on AWS,
behind a private network.
The app runs on Amazon Web Services in the United States, and the database has no route to the public internet.
Isolated database
The database sits in a private subnet with no internet gateway. Only the application servers can reach it, over TLS.
Encrypted daily backups
Automated backups run every day and are kept for 7 days, encrypted like the live database.
Rate limits and request checks
Each IP address gets 100 requests a minute. Every change to your data carries a CSRF token, and every response carries strict security headers.
Scanned dependencies
Dependabot proposes library updates every month, and each container image is scanned for known vulnerabilities before it ships.
Yours to export,
yours to delete.
Nothing about leaving requires a support ticket.
Export everything
Request a full export from settings. When it is ready, download it and keep it wherever you like. The same rights apply to everyone, under GDPR or CCPA.
Delete your account
One button in settings cancels billing, deletes your uploaded files, and disconnects your banks at Plaid. Everything else is permanently erased within 30 days.
We do not sell your data
The privacy policy says it in plain words: we do not sell, rent, or trade your personal or financial information.
Your SSN stays out of our logs
Social Security numbers and other sensitive details are never written to our system logs, and error reports blank them out before they are sent.
Common questions.
Still have a question?
Get in touch
Is StatementsReady secure?
Your statement is stored encrypted with AES-256 on AWS, with a second layer of encryption on Social Security and account numbers. Bank connections are read-only through Plaid. You can turn on two-factor sign-in, see every signed-in device, and delete your account from settings.
Can StatementsReady see my bank password or move money?
No. You sign in at your bank inside Plaid's window, and Plaid passes us a read-only token. That token returns balances and account names. It cannot start a transfer, and we never receive your password.
Does StatementsReady sell my data?
No. We do not sell, rent, or trade your personal or financial information. The privacy policy states this directly.
Is StatementsReady SOC 2 certified?
Not yet. Our controls are designed to the SOC 2 Type II standard and a certification is in progress.
What happens to my data when I delete my account?
Deleting your account cancels billing, removes your uploaded files from storage, and disconnects every bank at Plaid right away. Your statements and account data are permanently erased within 30 days. Export a copy first if you want one.
Do I have to use two-factor authentication?
It is optional and recommended. Set it up in settings with an authenticator app such as Google Authenticator or Authy, or by SMS, and save the backup codes somewhere safe.
How do I report a security problem?
Email security@statementsready.com with what you found and how to reproduce it, and please hold off on posting it publicly. We reply within 48 hours.
Start your statement.
Free for 7 days. No credit card.