Security & data handling

Your clients' bank data is on the line here. This page shows exactly how we protect it.

The short version: clients authenticate directly with their bank, so credentials never touch StatementFlow. Access tokens are AES-256-GCM encrypted at rest, every statement download is SHA-256 hash-verified, sensitive actions require passkey step-up, access is role-gated, and every action is logged. Files land in your firm's own Drive.

Everything described here is implemented today, in the same system we trust with Scale CPA's own client base. Written security documentation is available to firms on request.

Controls

The nine controls in place today

Credentials never touch us

Clients authenticate at the bank through Plaid Link or Mastercard Open Banking Connect. The system receives a scoped access token; the username and password stay at the bank.

AES-256-GCM encryption at rest

Every access token and source credential is envelope-encrypted with AES-256-GCM before storage, and the database itself is encrypted at rest.

SHA-256 verified documents

Each downloaded statement is hash-verified, so you can show that the file on disk is exactly what the bank served.

Signature-verified webhooks

Inbound bank-provider webhooks are cryptographically verified before anything is processed. Spoofed callbacks are dropped.

Passkey step-up (WebAuthn)

Sensitive actions like initiating a bank connection require phishing-resistant passkey confirmation on top of normal sign-in.

Role-based access control

Admin, manager, and staff roles gate who can add, refresh, reconnect, or remove connections. View/download rights are separate from control rights.

Activity log & job timelines

Administrative actions and every statement job (requested → fetched → verified → filed) are recorded with actor and timestamp.

No vendor lock-in on records

Statements route into your own Google Drive as they arrive, so the archive is yours from day one. No export ticket to file.

Built for failure, loudly

Retries with backoff, dual bank-data providers, and alerting on anything stuck. Failures surface to your team instead of silently leaving gaps.

Data handling

What we access, and what we can't

The system accesses

Official statement PDFs as the bank publishes them
Account metadata needed to file them (institution, account mask, dates)
Connection health signals (needs re-auth, fetch failed)

The system cannot

Move money, pay bills, or initiate transfers of any kind
See or store client banking credentials
Change anything at the bank; access is data-only

Infrastructure partners

Bank connectivity is provided by Plaid and Mastercard Open Banking (Finicity), regulated and audited aggregators that power much of US fintech. Statement files are routed to your firm's own Google Drive.

Documentation & disclosure

Our written information-security policy, data-retention & deletion policy, and at-rest encryption verification are available to firms under evaluation. Ask and we'll share them. Formal SOC 2 certification is on the roadmap as the platform scales. Until then, we'd rather show you real controls today than a badge tomorrow.

Found a vulnerability? Email security@example.com. Reports are read by the people who wrote the code.

Security questions firms ask

Is it safe to connect client bank accounts through Plaid?

Yes. This is the same aggregation infrastructure used across mainstream fintech. The client authenticates directly with their bank, often via the bank’s own OAuth page, so the firm and the software never see credentials. Access is data-only: statement documents and account metadata, with no ability to move money.

What exactly can StatementFlow see and do?

It can retrieve statement PDFs and the account metadata needed to organize them: the institution name, the account mask, and the statement dates. It cannot initiate payments, transfers, or any change to the account. The connection is read-only by design.

Where do the statement files live?

In your firm’s own Google Drive, under your organization’s control and retention rules, plus operational copies the system needs to verify and serve them. You are never locked out of your own archive.

What happens to data if we stop using the product?

Your Drive files are already yours. Connection tokens are revoked and stored data is removed per our written data-retention and deletion policy, which is available to any firm on request, along with our information-security policy.

Do clients have to share their online banking password with my firm?

No, and they never should. Credential-sharing (or worse, emailing statements and passwords around) is exactly the risk this replaces. The client signs in at the bank, and the firm receives verified documents. Credentials stay between the client and their bank.

Security review? Bring your checklist.

Early-access firms get our security documentation and a direct line to the person who built the system, not a sales engineer reading a wiki.

Get early access