Your bank statement never leaves your computer

What’s on a bank statement

Your name and address, sort code and account number, your salary, your rent or mortgage, where you shop, who you pay, and when. For a business, the same about every customer and supplier. It is one of the most sensitive documents most people own, and fraudsters value it for exactly that reason.

How StatementToCSV keeps it on your computer

The work happens in your browser

When you visit the site, your browser downloads the converter: ordinary JavaScript plus Mozilla’s open-source PDF reader, pdf.js, served from our own domain. When you choose a statement, your browser opens the file itself, reads the text, finds the transactions, checks the balances and builds the CSV. The CSV is saved straight from the browser to your Downloads folder. At no point is the statement, or anything from it, sent over the internet.

The browser enforces it

Every page is sent with a Content-Security-Policy, an instruction to your browser about what the page is allowed to do. Ours says the page may only connect to statementtocsv.co.uk and Cloudflare’s cookieless analytics. If any code on the page tried to send data anywhere else, the browser would block it. You can see the policy in your browser’s developer tools, under the network response headers.

Nothing to store

We have no database of statements, no user accounts for the converter, and no file storage. There is nothing to leak, because we never receive anything.

Check it yourself

1. Open the converter and convert one statement, or a sample, so the converter has fully loaded.
2. Disconnect from the internet (turn off Wi-Fi).
3. Convert another statement from your computer. It still works, because nothing needs to be sent.

Technical users can also open the browser’s developer tools, watch the Network tab while converting, and see that no request carries the file.

Layout reports

If a statement doesn’t convert well, the “Help us support this layout” button builds a report of its layout. It is created in your browser and shown to you in full. It keeps where text sits, dates and column headings; every name, amount, reference and account number is replaced with x and 1. It is never sent automatically: you download it and decide whether to email it.

Analytics

We count page visits with Cloudflare Web Analytics, which doesn’t use cookies and doesn’t see anything you do inside the converter. Read the full privacy policy.