Is it safe to upload bank statements to an online converter?

Search for a way to turn a bank statement into a spreadsheet and you'll find dozens of free online converters. Most of them work the same way. You upload the PDF, their server reads it, and you download the result. Before you hand a statement over, think about what's in it and who ends up with it.

What a bank statement gives away

A typical statement has your full name and home address, your account number (often printed in full) and the bank's routing number or sort code. It lists every transaction for the period, which shows who pays you, how much your rent is, where you shop, and which doctors, lawyers or charities you pay. The balances show roughly how much money you have.

For a fraudster, that's plenty to work with. Account and routing numbers can be used to attempt unauthorised debits, and a scam call from someone claiming to be your bank is far more convincing when they can read your real transactions back to you. If the statements belong to your clients, you're sharing their data, and your own legal duties go with it, for example the FTC Safeguards Rule for US tax preparers or GDPR in the UK and EU.

Six questions to ask any converter

1. Where is the file processed, on their servers or in your browser? If it's uploaded, the rest of these questions matter. If it never leaves your computer, most of them don't.
2. How long do they keep it? The privacy policy should give an actual time rather than "as long as necessary", and it should cover the converted data as well as the PDF.
3. Do they send it to anyone else? A lot of newer tools pass documents to an AI or OCR service run by another company. Your statement then falls under that company's retention rules too, and the company often isn't named.
4. Is it used to train models? You want the policy to say no in so many words. If it doesn't mention training, don't assume the answer is no.
5. Can staff look at it? Support teams reviewing failed conversions are a common way for a real person to end up reading your statement.
6. Who runs the site? If there's no company name, address or privacy policy, there's nobody to hold to any of the answers above.

Check it yourself in two minutes

You can see for yourself whether a converter uploads your file, because your browser records every request a page makes.

1. Open the converter, then open your browser's developer tools with F12 on Windows or ⌘⌥I on a Mac.
2. Go to the Network tab and clear it.
3. Convert a statement (an old one is fine) and watch the list fill up.
4. Sort by Size, or look at what was sent just after you picked the file. An upload shows up as a request about the size of your PDF, often a POST.

A converter that works in your browser still makes a few requests, to load the page and perhaps to count usage or record analytics. None of them should be anywhere near the size of your statement.

If you do upload, reduce what you send

Be careful with redaction. In most PDF editors, drawing a black box over an account number only hides it on screen, and the text underneath can still be copied out. A proper redaction tool removes the text itself.

If the service lets you delete your files, do it once you've downloaded the result. And for client statements, only use a tool you'd be comfortable naming to the client.

How statement2sheets handles it

statement2sheets converts statements inside your browser. The engine is compiled to WebAssembly and runs on your own computer, so neither the PDF nor the transactions in it are ever sent to us or anyone else. Our servers record how many pages you've converted, plus your plan and account if you sign in, and nothing about what was on those pages. You can confirm this in the Network tab using the steps above. The security page has more detail, or you can try it on a statement.