Security and privacy

Bank statements contain sensitive financial data, so the MVP is designed around short file retention, account-number masking, and reviewable processing.

Free-user files should be deleted automatically after 24 hours. Admins should see metadata by default, not raw statement files.

Uploaded files are not intended for AI training. OCR and AI subprocessors must be disclosed before production launch.