FinBizDoc

Security & privacy

Built for documents you would not hand to a stranger

A payslip or bank statement is one of the most revealing documents a person or a business owns. The controls below are structural, not optional settings.

Version
v1.0.0
Effective
Last updated

Access and isolation

  • Authentication is required for every real document upload.
  • Documents live in a private storage bucket with no public URLs.
  • Row-level security is enabled on every table that holds user-owned financial data.
  • Server-side functions re-check ownership on every request, so a route guard is never the only protection.
  • Downloads use short-lived signed URLs that expire.
  • Two different users cannot read one another's rows. This is verified by explicit isolation tests before release.

Document reading, step by step

The short version: our own code does the reading and the arithmetic, the AI only puts labels on masked text, and you confirm everything before it counts.

  1. 1Step 1

    Your file lands in private storage

    Uploads go straight into a storage area only your account can open. No public link is ever created.

  2. 2Step 2

    Our server reads it, not the AI

    CSV, XLSX and digital-PDF text are parsed by ordinary code. Every date, amount and balance we use comes from this step.

  3. 3Step 3

    Personal details are removed before any AI call

    Account numbers, GST registration numbers, PAN numbers, IFSC codes, card numbers, Aadhaar numbers and more are replaced by type tokens. You can add names, addresses and reference codes, or withhold description text entirely.

  4. 4Step 4

    The AI only labels — it never calculates

    The model is asked one narrow question: which column or line name belongs to which group. It cannot add, change or invent a number.

  5. 5Step 5

    You review every line before anything counts

    Extraction produces a draft. Nothing enters your dashboards, ratios or reports until you confirm it — there is no path that skips this.

  6. 6Step 6

    Every figure is computed by our own formulas

    Totals, ratios, EMIs and readiness scores are produced by versioned, tested code you can inspect in the formula library.

Before processing starts you get a panel listing exactly which columns would be sent, how many personal values were found in each category, and which text would be withheld — with an option to redact more. After extraction, the same summary is kept with the draft so you can always check what was analysed. Masked content is never displayed and never stored in the extraction record.

Before anything reaches the AI model

  • Account numbers, PAN and similar identifiers are masked.
  • Only the fields needed for the requested analysis are sent.
  • Document text is framed as untrusted data. Instructions embedded inside a document — a prompt-injection attempt — are ignored, never obeyed.
  • Prompts containing unmasked personal data are never stored.

What we never ask for

  • Internet-banking username, password, PIN or OTP. There is no screen that requests them.
  • Card details of any kind.
  • Access to your accounts through an aggregator session or screen scraping.

Retention and deletion

By default the original uploaded document is deleted once processing and your confirmation are complete. You may explicitly choose to retain it instead. Independently of that setting you can delete:

  • the original document,
  • the extracted transactions,
  • the generated assessments and reports,
  • or everything associated with an analysis, in one action.

Deletions are recorded as audit metadata — what was deleted and when — never the deleted content itself.

Logging

  • Document contents never appear in application logs.
  • Secrets, API keys and internal prompts are never logged or returned to the browser.
  • Errors shown to you are safe, generic messages; stack traces stay server-side.

API keys

The AI provider key is held only as a server-side secret. It is never present in frontend code, never exposed as a browser environment variable, never written to the database, never committed to source control, never displayed in the interface and never included in an API response.

Repository hygiene

  • No real financial documents are committed. Fixtures are synthetic.
  • .env.example lists variable names only, with no values.