Security & data handling

Bank statements are your clients' private financial lives. Here is exactly where that data goes when you use TidyBooks — tool by tool, with no marketing fog.

Browser converters (CSV → QBO, QBO → CSV/Excel) — live today

your file → your browser's memory → your download folder

The conversion code is bundled into the web page itself. Your file is read and converted by JavaScript running on your machine — it is never uploaded, never touches our servers, and works even if you go offline after the page loads. We record anonymous usage events (a conversion happened, how many rows, whether the balance check passed) — never the file, never its contents, never account numbers.

PDF converter (PDF → QBO, PDF → Excel) — live today

your file → encrypted upload → server memory only → AI extraction (zero-training commercial API) → gone when the request ends

PDF extraction requires server-side AI, so — unlike the browser tools — the file does leave your machine. We are explicit about what that means: your PDF is held only in the memory of the serverless function that processes it. It is never written to disk and never stored — there is nothing to delete, because nothing is kept. Extraction runs on enterprise AI infrastructure under commercial terms where your data is never used to train models. Statement contents never enter our logs or analytics — we record only anonymous metadata (page count, duration, whether the balance check passed). We'd rather tell you this plainly than pretend a cloud service is magically local.

One explicit exception, always your call: if a conversion fails, we offer a “Share this file” button. Only if you click it, that one PDF is stored — for up to 30 days, encrypted at rest in our database, accessed only by us to debug why extraction failed, then deleted. Nothing is ever kept without that click, and declining changes nothing about your result.

This is also why the PDF tool exists at all: pasting a client's statement into a consumer chatbot means personal accounts, stored history, and no contractual guarantees. TidyBooks packages the guarantees a professional needs — and publishes its accuracy methodology so you can verify the output, not trust a banner.

Desktop edition — planned

your file → your computer's own processor → never leaves the machine

For firms whose policies forbid any cloud processing, a desktop edition with fully local extraction is on the roadmap. Statements will be processed entirely on your hardware. Email us if that's the version you're waiting for — it directly affects how soon we build it.

What we never do

We never sell data, never use statement contents for AI training, never log transaction data, and never publish accuracy claims we can't show the methodology for. If any of this changes (it won't), this page changes first.