Is it safe to upload bank statements online?

What happens when you upload a statement

When an online tool asks you to upload a statement, the PDF is copied to the company’s servers, or to a cloud provider they use, and processed there. Depending on the service, it may be kept for minutes, days or indefinitely; it may be read by staff for support or quality checks; and some services use uploaded documents to improve their software. None of that is necessarily wrong, but each copy is another place your financial details can leak from, and you usually can’t check what happened to it.

Questions to ask before uploading

• Who receives the file? The company, and any processors it uses (cloud hosting, document-reading services).
• Where is it stored, and for how long? Look for a specific deletion period, not “as long as necessary”.
• Is it used for anything else? Training software, analytics, marketing.
• Is it a client’s statement? If you are an accountant or bookkeeper, uploading a client’s data to a third party is processing their personal data. You may need a lawful basis and a data processing agreement with the tool, and should be able to explain where the data went.
• Do you need to upload at all? For converting to CSV, you don’t.

When you do have to share a statement

Mortgage lenders, landlords and letting agents often ask for statements as part of their checks. Before sending:

• Use the lender’s or agent’s secure upload portal rather than plain email where one is offered.
• Check you are dealing with the real company: be wary of unexpected requests for statements, especially by text or social media.
• Send only the months asked for.
• Some lenders now offer to check your income through Open Banking instead, where you give read-only access for a short time. Ask if it’s an option.

Converting without uploading

StatementToCSV converts statements inside your browser, on your own computer. The file isn’t uploaded, stored or seen by anyone. The page’s security policy tells your browser to block it from sending data anywhere except our own site, and you can test it: convert one statement, disconnect from the internet, and convert another. See how it keeps statements private.