Local processing means the application server
Uploaded files are transmitted from your browser to the FinanceConvert server. Structured exports and supported simple PDFs are parsed on that server, without a model API. This is not browser-only or offline processing.
Temporary files and downloads
The application holds uploaded and converted file bytes in memory. Processing inputs are removed after a conversion attempt. Temporary downloads expire after 15 minutes or first use. Separately, each accepted source document and conversion result is retained in a private encrypted archive for 90 days, including failures. Temporary download expiry does not remove that archive. Application file retention is separate from operating-system behavior, infrastructure logs and external provider policies; “RAM-only” is not a claim of zero risk or guaranteed physical erasure.
Cloud extraction is an explicit choice
For difficult PDFs, paid users can enable Mistral cloud extraction. The local reader is tried first. When needed, relevant PDF page groups are sent to Mistral’s document processing API. Mistral’s processing and retention terms apply to that transfer. Do not enable cloud extraction for documents your organization prohibits from being processed by that provider.
Private review archive
Review records are encrypted with AES-256-GCM and opaque identifiers, stored outside the public website directory, and readable only with the operator’s archive key. The archive key must be backed up separately and access to both storage and key restricted. Documents are not committed to the source repository. There is no HTTP endpoint to read archive bytes. Stored transactions are extraction results, not verified ground truth.
Use the document receipt to delete a live review copy or contact the operator. Operators must run the expiry job daily and test separate archive backups and restoration. Encryption does not hide documents from an operator who has access to the storage and key.
What is retained
Accounts, password hashes, sessions, page allowances, subscription references and conversion metadata are persisted in PostgreSQL in production. Conversion history contains formats, status, page count, elapsed time, provider and estimated costs. Statement contents and original filenames are not stored in conversion history. Stripe processes payments; card numbers are not held by this application.
What the controls do
The application validates upload size, checks supported paths, limits simultaneous conversions, checks download ownership for account files and enforces PDF allowances. Downloads use unguessable identifiers and expire. Guest download identifiers act as temporary access links: anyone you give one to can use it before expiry.
Before importing
Inspect the preview and warnings. A balance check does not prove completeness, and OCR can misread characters. Amounts are not automatically changed to resolve discrepancies. Try exports with a copy or test company before importing into a live accounting workflow.
For requests concerning your account or retained metadata, see contact information and the privacy notice.