Security

Cratebooks handles financial records, so the data flow should be understandable before you import anything. This page explains what reaches our systems and the controls currently in place.

1. What happens when you import

1. You choose a statement file on your device.
2. The file is parsed in your browser. There is no statement-file upload endpoint.
3. You preview supported PDF imports before confirming them.
4. The transaction rows the file contains, including date, amount and statement description, are sent over HTTPS for categorisation and storage. This happens before you review them: categorisation is what produces the review queue. You then decide which rows count.
5. Your reviewed records remain available in your account until you remove them or delete the account.

2. What Cratebooks stores

• Your email address and a bcrypt password hash, never a readable password.
• Imported transaction rows and the categorisation decisions you make.
• The current categorisation engine is rules-based. Imported transaction rows are not sent to a third-party generative AI model.
• Learned merchant rules, tax setup, completeness confirmations and mileage records.
• A Stripe customer reference and subscription status. Stripe holds card details.
• Limited technical logs needed for security and abuse prevention.

Bank statement descriptions can contain names or other personal information entered by a payer. Treat imported records as sensitive and protect access to your account.

3. Controls in place

• HTTPS and HSTS for traffic, plus browser security headers including a content security policy, clickjacking protection and content-type protection.
• Bcrypt password hashing, expiring signed sessions, rate limits on authentication routes and optional Google sign-in.
• Optional authenticator-app two-factor authentication.
• User-scoped database queries. Account identity comes from the verified session, not a client-supplied user id.
• Formula-injection protection in CSV and Excel exports, output escaping in the app and request-size limits.
• Managed PostgreSQL hosting on Render with encrypted disks, private networking and managed backups.
• Sentry error monitoring configured not to include default personal information or transaction request bodies.

4. Deletion and retention

You can delete your account from the app. Live account data, transactions and learned rules are removed through a cascading deletion. Residual copies in managed backups age out through the hosting provider's backup cycle. Limited billing or legal records may be retained where the law requires it.

5. Current limitations

• Transaction rows rely on managed database encryption, network isolation and application-level access controls. They are not separately encrypted field by field because the service needs to read them for categorisation and re-scanning.
• Database tenancy is enforced and tested at the application layer. PostgreSQL row-level security is a future defence-in-depth improvement.
• The current frontend uses inline JavaScript, so its content security policy allows inline script. User-controlled output is escaped and covered by regression tests.

6. Reporting a security issue

Please email security@cratebooks.com. We aim to acknowledge genuine reports within 48 hours. Do not access, alter or retain another person's data while testing.

7. More information

See the Privacy Policy for data-processing purposes, subprocessors and your rights. Security controls reduce risk but no online service can promise absolute security.