What we do with your statements — and what we never do

Where your data lives

• Private storage, never public

  Uploaded statements go to private object storage with public access blocked. Nothing can read a file without a short-lived signed link that is tied to your account and expires in about a minute. Every link we issue is written to an audit trail.

• Checked before anything reads it

  Every upload is scanned for malware before the parser is allowed near it. If the scan cannot run, the file is not processed — the system fails closed, never open. Files that fail are removed without being opened, and the event is recorded.

• Your financial values stay out of our logs

  Amounts, merchant descriptors, and file contents are kept out of application logs, error reports, and analytics by design, with a redaction layer that strips sensitive values and a lint rule that keeps stray logging out of the codebase.

• Isolation between accounts

  Every record carries its owner, every request re-checks ownership, and a request for someone else’s data returns the same "not found" response as a record that never existed — so the API cannot be used to discover what exists. Cross-account access is covered by automated tests.

How the numbers work

The audit is deterministic: the same statement always produces the same result. No model decides what you are paying.

• Exact arithmetic, in whole cents

  Totals are integer-cent sums of the charges shown on the page. Nothing is rounded for effect, projected forward, or averaged into a friendlier number.

• Evidence on every charge

  Each recurring charge shows how many times it was seen, the dates it was seen between, and the basis for calling it recurring — so you can check our work against your own statement, line by line.

• Honest labels instead of confident guesses

  A charge we are confident about is labelled "Recurring". One we are not is labelled "Needs your review" and waits for you. If we identify a merchant wrongly, you can correct it, and your correction wins over our catalogue on every future re-run.

• AI cannot touch your figures

  The optional AI summary — switched off during the open beta — never computes anything. It receives derived facts only (merchant names, amounts, cadence), never your uploaded documents, and every figure it states is checked against the deterministic numbers before display. A response that cannot be verified is blocked and replaced with the plain facts rather than shown to you.

Your account and your controls

• Two-factor authentication, optional and strongly recommended

  A LowScout account can show someone a map of your recurring finances, so a second factor matters here. It is one click away in Settings → Account & security — an authenticator app plus backup codes. We do not force it, because a locked-out account is its own kind of data loss and self-serve recovery is not built yet.

• Consent per capability, never bundled

  The privacy policy and terms are what you accept to use the product. Optional capabilities — AI summaries, cancellation tracking — ask separately, at the moment you first use them, and each can be withdrawn on its own with immediate effect. Withdrawing one never costs you your account or your audit.

• Delete a statement whenever you like

  Deleting a statement removes the stored file and takes its transactions out of your audit. The confirmation tells you exactly what will change before you do it.

• Delete or export everything, by email

  Email support from your account address and ask to delete your account or to receive a copy of your data. We verify it is you, then act. Self-serve buttons for both are not built yet, so a person handles the request — which is why it takes a couple of business days instead of a click.

What we deliberately do not collect

These are architectural rules in the codebase, not settings someone can quietly change for a growth experiment.

• No advertising pixels on signed-in pages

  No advertising or ad-network pixel runs on any page you see while signed in — from any network, for any purpose.

• No session recording on signed-in pages

  Session replay is disabled on every authenticated route. Financial screens are never recorded, and masking is not treated as an acceptable substitute for not recording them.

• A fixed, reviewed event list

  Product analytics is limited to a documented list of events carrying low-cardinality counts and category codes. No amounts, no merchant names tied to a person, no file names, no free-form text. Adding an event means changing the documented list, not adding a line of code.

• No attribution tracking

  We cannot tell you where a signup came from, because the rules above cost us that data. That is a deliberate trade, and we would rather state it than quietly add tracking to close the gap.

Who else is involved

LowScout runs on a small number of infrastructure providers. None of them are advertising companies, and none receive your statements for their own purposes.

• Authentication

  Sign-in, email verification, and optional two-factor enrolment are handled by a specialist authentication provider. Your password is never stored by us.

• Storage and database

  Uploaded files live in private cloud object storage; your parsed transactions and audit live in a managed PostgreSQL database. Both are access-controlled to the application.

• Processing and hosting

  Statement processing runs on a dedicated background service separate from the website, so a slow or failed job never takes the product down.

• Error monitoring

  Crashes and errors are reported to a hosted monitoring service so they get fixed. Reports carry identifiers and error types — never your financial values or file contents.

• Bank connections (optional)

  If you choose to connect an account, Plaid establishes and maintains the connection. You authenticate in Plaid’s flow at your bank; LowScout receives transaction activity (dates, amounts, descriptions) plus the account name and last four digits — never your bank credentials, full account numbers, or balances. The access credential is stored only in encrypted form on a separate background service, and disconnecting ends the connection at Plaid and deletes the imported transactions.

An open beta with an honest gap list is worth more than a polished page that implies everything is finished.

• Self-serve account deletion and data export. Both are handled by a person on request today, within two business days.
• A published uptime status page. Incidents are communicated by email to anyone affected, and written up afterwards.
• Automatic alerts about changes in your spending. Your audit updates when you upload a statement, not in the background.
• The AI summary. Built, but switched off until our provider’s data terms meet the no-retention, no-training bar.
• A formal third-party security audit or certification. We have not had one, and we will not imply otherwise.

• A wrong figure, or a cancellation wrongly shown as verified, is treated as the most serious kind of bug and stops other work the day it is reported.
• If something breaks in a way that affects your data or your access, we tell you what happened, what it means for you, and what we changed — even when the honest answer is "we do not know yet".
• If a security issue is confirmed, affected people are contacted directly. We do not wait for a fix to be finished before telling you that something happened.
• Good-faith security research is welcome: email us with what you found. We will not threaten anyone for reporting a problem. There is no bug bounty, because there is no revenue to fund one.