What happens to your statement

A bank statement holds some of the most sensitive information a person has. This page describes, step by step, what DocFig does with one. Every statement here describes how the service runs today. If that ever changes, this page changes first.

The short version

• No account, no sign-up, no file history.
• Your PDF is held in memory while it is converted and is never written to disk.
• Account, card and long reference numbers are masked before any text is sent to the AI model.
• The finished rows are handed to your browser once, then deleted from the server.
• No advertising, no third-party scripts or trackers on this site. One first-party cookie counts returning visitors, and it can be turned off.

Step by step

1. Connection. The site is served over HTTPS only. Traffic passes through Cloudflare's network, which decrypts and re-encrypts it on the way to the DocFig server; the second leg is also encrypted and the server's certificate is verified.
2. Upload. The web server is configured to pass the upload straight to the application without buffering it to a temporary file. The application keeps the upload in memory; it does not save it, and the server has no swap space, so memory is not paged out to disk.
3. Several files at once. When you add more than one statement, each file is held in memory, never on disk, until it converts, for at most 15 minutes, so page counts and passwords can be checked before anything is converted. To build the combined workbook, your browser sends back the converted rows, which are combined in memory and returned straight away; nothing is kept.
4. Reading the PDF. The text is extracted in memory. A scanned page with no text layer, or a photo uploaded as JPG, PNG or HEIC, is turned into an image in memory and read by OCR software running on the same server, which receives the image through a pipe and returns text the same way. The file's own name never reaches the server: the browser sends the upload under a generic name and names your download itself.
5. Password-protected PDFs. If the statement is locked, the browser asks for its password and sends it over HTTPS with the file. The server uses it once, in memory, to open the PDF, then discards it. The password is never logged, stored, counted or sent to the AI model, and the unlocked copy exists only in memory like any other upload. Wrong guesses are limited to 10 per file per hour.
6. Masking. Before any text leaves the server, runs of eight or more digits, card numbers written in groups of four, and IBANs are replaced with placeholders such as [N1-4417], which show only the last four digits. Amounts and dates are not masked, because the conversion needs them. Names, addresses and transaction descriptions are not masked either; they are sent as printed.
7. AI extraction. The masked text of each page is sent over HTTPS to OpenAI's API, which returns the transactions as structured data. OpenAI states that data sent to its API is not used to train its models by default and may be retained for up to 30 days to detect abuse; see OpenAI's API data controls. No other AI service is used.
8. Checking. The placeholders are swapped back on the DocFig server, and the rows are checked against the statement's balances and page text, all in memory.
9. Result. The rows wait in server memory until your browser collects them, which normally happens within a second of finishing, and are deleted in the same step. If a browser never collects a result, it is deleted after 15 minutes. The uploaded PDF itself is released as soon as its text has been read, before the AI step begins.
10. Download. To build an Excel or CSV file, your browser sends the rows back to the server, which builds the file in memory, returns it, and keeps nothing. The table you see stays only in your browser tab; closing the tab discards it.

What is kept, and for how long

• A page count for today's free limit. Stored against a keyed hash of your IP address and the date, never the address itself, and deleted after the day ends. A daily total of pages and files across all visitors is kept with no link to anyone.
• Web server logs. Like any website, the server logs each request: IP address, time, page address, status and size. These logs never include file contents or file names. They are kept for 14 days for security and troubleshooting, then deleted.
• Daily usage totals. To see whether the site is used, the server counts, per day: page views per page, unique visitors, uploads, conversions and their outcome (by error type, never by content), pages converted, processing cost, limit refusals, the referring website's domain name only, and the country Cloudflare reports. To count each visitor once, a hash of the connection is made with a random value generated for that day, and both the hashes and that day's random value are deleted after the day ends, so visits cannot be linked from one day to the next. No cookie is used for these totals, and no IP address, browser details, full link or file content is stored. Requests that look automated are not counted.
• Returning visitors. A first-party cookie, df_vid, holds a random ID set on the first visit. The server stores only a keyed hash of it with the first and last day it was seen, to count new and returning visitors, and deletes records not seen for 13 months. It is not set when you turn visitor counting off on the cookie page, or when your browser sends Global Privacy Control or Do Not Track.
• Error records. If a conversion fails, the application records only the type of error, never text from the file.
• Things you choose to send. The waitlist and contact forms store what you type, and email a copy to the DocFig inbox. See the privacy policy.

What is not on this site

No analytics or tracking scripts from any company, no advertising, no social media widgets, and no fonts or scripts loaded from other companies. DocFig sets three first-party cookies: a security token that protects the forms, the returning-visitor ID described above, and a cookie that remembers if you turned visitor counting off; the cookie notice lists them. The site sends a strict Content Security Policy, so the browser refuses to run any script that does not come from DocFig itself.

Limits worth knowing

While a file is being converted it exists, briefly, in the memory of a server and, in masked form, with OpenAI as described above. If your situation means a statement must never leave your own computer, an online converter of any kind is the wrong tool, and copying the figures by hand or using desktop software is the safer choice.

Found a security problem? Please email hello@docfig.com. The same address is listed in security.txt.