Security

1. What happens when you import

1. You choose a statement file on your device.
2. The file is parsed in your browser. There is no statement-file upload endpoint.
3. You preview supported PDF imports before confirming them.
4. The transaction rows the file contains, including date, amount and statement description, are sent over HTTPS for categorisation and storage. This happens before you review them: categorisation is what produces the review queue. You then decide which rows count.
5. Your reviewed records remain available in your account until you remove them or delete the account.

We also receive limited PDF import diagnostics: parser version, page and row counts, restricted error codes, a coarse bank name and a file fingerprint used to link repeat attempts. These diagnostics do not contain the original file, its text, transaction descriptions, dates, amounts or balances.

2. What Cratebooks stores

• Your email address and a bcrypt password hash, never a readable password.
• Imported transaction rows and the categorisation decisions you make.
• The current categorisation engine is rules-based. Imported transaction rows are not sent to a third-party generative AI model.
• Learned merchant rules, tax setup, completeness confirmations and mileage records.
• A Stripe customer reference and subscription status. Stripe holds card details.
• If you connect HMRC, encrypted authorisation tokens and your National Insurance number, along with business details and submission history.
• If you set up authenticator verification, an encrypted authenticator secret and hashed recovery codes.
• Limited technical logs needed for security and abuse prevention.

Bank statement descriptions can contain names or other personal information entered by a payer. Treat imported records as sensitive and protect access to your account.

3. Controls in place

• HTTPS and HSTS for traffic, plus browser security headers including a content security policy, clickjacking protection and content-type protection.
• Bcrypt password hashing, expiring signed sessions, rate limits on authentication routes and supported third-party sign-in where offered.
• Authenticator-app verification for HMRC actions. This additional step does not apply to ordinary sign-in.
• User-scoped database queries. Account identity comes from the verified session, not a client-supplied user id.
• Formula-injection protection in CSV and Excel exports, output escaping in the app and request-size limits.
• Managed PostgreSQL hosting on Render with encrypted disks, private networking and managed backups.
• Sentry error monitoring configured not to include default personal information or transaction request bodies.

4. Your HMRC connection

HMRC features are available only when enabled for your account. You authorise the connection directly with HMRC; Cratebooks does not ask for or receive your Government Gateway password. We store the access and refresh tokens issued by HMRC, and the National Insurance number you provide, encrypted at rest.

Connecting to HMRC and requests to read HMRC information or file an update require additional authenticator verification. A recent verification can cover more than one action during its permitted window; not every action asks for a fresh code. This is separate from ordinary Cratebooks sign-in. Connecting does not itself submit your figures: you must review the preview and confirm each submission or amendment.

During HMRC workflows we send required fraud-prevention information about your account, browser, device and network connection, as described in the Privacy Policy. Some privacy relays or network settings prevent us obtaining the connection information HMRC requires. If this happens, the app asks you to try another connection or temporarily pause the relevant protection. Importing, reviewing and exporting your records still work.

You can disconnect HMRC from your Account. This removes the connection tokens and National Insurance number from your live account data; it does not revoke authorisation held by HMRC or withdraw updates already submitted. Submission history is kept separately while your account remains open, and disconnecting does not remove your authenticator setup. Backup retention is described below.

5. Deletion and retention

You can delete your account from the app. Live account data, transactions and learned rules are removed through a cascading deletion. Residual copies in managed backups age out through the hosting provider's backup cycle. Limited billing or legal records may be retained where the law requires it.

6. Current limitations

• Transaction rows rely on managed database encryption, network isolation and application-level access controls. They are not separately encrypted field by field because the service needs to read them for categorisation and re-scanning.
• Database tenancy is enforced and tested at the application layer. PostgreSQL row-level security is a future defence-in-depth improvement.
• The current frontend uses inline JavaScript, so its content security policy allows inline script. User-controlled output is escaped and covered by regression tests.

7. Reporting a security issue

Please email [email protected]. We aim to acknowledge genuine reports within 48 hours. Do not access, alter or retain another person's data while testing.

8. More information

See the Privacy Policy for data-processing purposes, subprocessors and your rights. Security controls reduce risk but no online service can promise absolute security.