Is it safe to upload bank statements to a converter?

Published 13 September 2026 · by Tekiba

With most online converters, uploading a statement means trusting a server: the file is sent to one, parsed there, and deleted some time afterwards. If you would rather a document carrying your name, your account number and every payment you made did not leave your computer, use a converter that does the whole job inside the browser tab — a claim you can check yourself in a minute. Uploading is not automatically unsafe; several services are run carefully and say plainly what they do.

What happens when you upload one

What makes the question worth asking is the contents: a name, an address, an account number, and a dated list of who you paid, which describes where you live, where you shop and roughly what you earn. A leaked password can be changed in a minute; a leaked statement cannot be taken back. Bank statement PDF privacy goes through what a statement reveals, line by line.

Most online converters are ordinary web applications: your browser sends the PDF to a server, a parser runs there — often with OCR or a machine-learning model behind it — and the table comes back. The file has to reach the server for any of that to happen. OCR is the part that is hard to do in a browser, and it is only needed for a scan: whether your statement is scanned or text decides how much of that machinery your file actually needs.

The clearer services say so directly. Bank Statement Converter's privacy policy, under Information we collect, states:

“Documents uploaded to Bank Statement Converter persist on our servers for 24 hours. After 24 hours they are deleted.”

“We do not forward user uploaded documents to any third parties.”
bankstatementconverter.com/privacy, retrieved 13 September 2026

ConvertStatement describes a different arrangement in its Bank statement data section — still a server, but nothing written down:

“By default, ConvertStatement processes uploaded PDF files entirely in memory.”

“Your bank statement data is not written to disk, stored in a database, or logged.”
convertstatement.com/privacy, retrieved 13 September 2026

Both are quoted because they are specific, not because anything is wrong with them — they are clearer than most policies you will read. That is the point: the question is rarely whether a company means well, but whether you can tell from what they wrote down what happens to your file. HTTPS does not answer it.

Five things to look for before you upload

Where the conversion happens. Look for the mechanism, not the mood. “Processed in your browser” describes one design; “uploaded to our servers” describes another. If a policy never says, assume the file is uploaded — that is how most web applications are built.
A retention period with a number in it. “Files are deleted automatically” is not a retention policy; deleted when? “Within 24 hours” or “within 30 days” are. A number is something you can hold a company to.
Whether deletion covers backups and logs. Removing the file from the main store is the easy half. Policies that have thought about it say what happens to backups and server logs; where a policy is silent, that is a question to ask rather than an answer.
Who else receives the file. Look for a sub-processor list, or wording about OCR, AI or analytics providers. Passing your PDF to a third-party extraction API is a reasonable design, but a second company then holds your statement and you should know its name.
Whether an account is involved. A service that requires sign-up links that statement to your email address, your payment details, and everything else you have converted. One with no account has far less to join up — though a statement identifies you by itself, and cookies can still tie visits together.

If a policy answers all five in plain words, you can decide — including deciding to go ahead. If it answers with adjectives — “bank-level security”, “military-grade encryption”, “we take your privacy seriously” — you have been reassured without being told anything.

Converting without sending the file anywhere

There is a third option: the conversion happens where the file already is. Browsers can read a local file and run a PDF parser without a server in the loop, so a converter can be a static page doing the work in the tab, the CSV built in memory and handed back as a local download.

LedgerDrop is built this way — a static site with no application server or database behind it. Converting a bank statement to CSV without uploading it goes through what that looks like in practice, and where such a converter stops being able to help; checking a converted CSV for errors covers the separate question of whether the file that came out is right. But do not take any of it on faith, here or anywhere else. How to check it:

Check it yourself in about a minute

Open the converter.
Open developer tools — F12, or ⌥⌘I on a Mac — and go to the Network tab. Tick Preserve log.
Reload. You will see the page, a stylesheet, a handful of small scripts and the PDF-reading library, all from ledgerdrop.tekiba.app, plus Google Analytics. Nothing from the payment provider: that is not fetched unless you press a buy button.
Convert a statement and watch the list. Two things appear: pdf.worker.min.mjs, the PDF library's background worker, from this same site — and a Google Analytics event. Nothing goes out carrying your file, its text, or the table that came out of it.
Stronger still: convert one file, then turn off your Wi-Fi and convert another. It works — nothing left is waiting on the network.

The worker arrives when you convert rather than when the page loads, which is why the Wi-Fi test needs that first conversion. Afterwards it comes from your browser's cache and does not reappear in the list — unless you have ticked Disable cache, in which case it is fetched every time.

A check that does not rely on trusting the page

The Network tab tells you what the code did this time. There is also a rule the browser enforces whatever the code tries to do: every page here carries a Content-Security-Policy header listing the destinations it may contact at all. Click the document request and look at the response headers.

The directive governing fetches and beacons is connect-src, and the part to look at is what is not in it. It does not include 'self', so the page may not POST anything back to ledgerdrop.tekiba.app — the loophole a claim like this usually has — and form-action 'none' blocks form submission anywhere. What it does name is Google's analytics domains, paddle.com for the checkout, license.tekiba.app, which turns a payment into a licence key, and tekiba-license-sandbox.metluno.workers.dev, a sandbox copy of that licence service which only a test build of this site ever uses — a policy is attached to a response rather than to a hostname, so it has to be named here even though this page never reaches it. Those are the four places this page may talk to, and none of them is a place a statement could be sent, because the code that can reach them cannot read one. A converter that listed its own origin there would be a different proposition, and that is the thing to check on any site making this claim, including this one. That bars the ordinary routes rather than every conceivable one: img-src 'self' still permits a same-origin image request, and the CDN serving this site would see the URL of one — there is no application behind it to store a statement, but the request would still be made. Treat the policy as a narrowing rather than a sealed box. It removes the easy ways and leaves the rest where the request list would show them.

What LedgerDrop itself sends is a short list of anonymous counters: whether a conversion succeeded, how many pages and rows it involved and roughly how many files were read together, which kind of file you saved (CSV, QBO, OFX or QIF — the word, not the file), and — if you press a button — whether it worked for your bank. The rest count the purchase steps, which guide led to the converter, requests for the test-statement pack and downloads of its free samples, in fixed words. They go through Google Analytics, which also receives what any GA page view sends: a browser identifier, your IP address, your browser and operating system, and the page you are on. No file name, no bank name, no amounts, no descriptions; the full list is on the privacy page.

Questions

Is HTTPS enough to keep an uploaded bank statement private?

No. HTTPS encrypts the file while it travels to the server and says nothing about what happens once it arrives — whether it is written to disk, how long it is kept, who can read it, whether backups outlive the deletion timer, or which other companies the server passes it to. Every converter worth using has HTTPS, so its presence does not distinguish one from another. The padlock describes the pipe, not the building at the other end.

Is a converter that runs in the browser automatically safe?

No — “runs in your browser” is a claim like any other, and worth checking rather than believing. What is unusual is that you can check this one yourself: watch the Network tab, then read the site's Content-Security-Policy header to see which destinations the browser will permit at all. Neither check depends on trusting the company. What it does not protect you from is your own machine — if your computer has malware on it, the statement was exposed before you opened any website.

What should I do if I have already uploaded a statement somewhere?

Read that service's privacy policy for its retention period, then ask them to delete the file and close the account. In the UK and EU the GDPR gives you a right to erasure, and California's CCPA a similar one, so a deletion request is normally something they must act on rather than a favour — both carry exemptions, and both depend on the service falling under them at all. After that, watch the account for payments you do not recognise. There is no way to un-send a file, so the decision that matters is the next one.

The habit worth having is not avoiding every service that uploads, but knowing which kind you are using before you drag the file in. You can try the converter, read how far back you can download bank transactions as CSV or why “PDF to Excel” makes bank statements messy, or go back to the home page.