Security

Where your data goes

For a text PDF, which is what online banking gives you, your data goes nowhere. The file and its transactions stay in your browser tab.

You can check the first flow yourself. Open your browser’s network tab, convert a text PDF, and look for a request that carries the file. There isn’t one. Once the site has loaded, it also works offline, because a service worker keeps the site’s own files on your device.

What we store

Accounts are optional. You need one only for a paid plan. If you have one, we store this in a database on Cloudflare (D1):

• Your email address.
• Your plan and billing status. That includes the payment provider’s customer and subscription IDs, never card details.
• How many pages you have used in each billing period.
• Your sign-in sessions: a hashed token, when it was created and when it expires.
• On the Firm plan, which email addresses are on the team.

Sign-in is a one-time link sent to your email. There are no passwords to leak.

Two things stay in your own browser’s local storage and are never sent to us: the free daily page count, and the fingerprints used to count each statement once. The privacy policy has the full list, with retention times.

What we never store

• Your statements. For text PDFs we never receive them.
• Transactions, balances or account numbers from a statement.
• The names of the files you convert.
• Card numbers. Payments are taken by the payment provider.
• Passwords. We don’t have any.

Our analytics are Cloudflare Web Analytics, which is cookieless. Nothing from your statements goes into it, and there are no tracking or advertising cookies.

Scanned PDFs (planned)

Reading scanned and photographed statements is not live yet. This is how it will work, and this page will be updated before it goes live.

• It runs on a server, through a third-party OCR provider, because a scanned page has to be read from an image.
• It needs your consent click for each file. Nothing is sent before that.
• Files are deleted within 1 hour.
• Files are never used for training.
• The provider will be named on the subprocessors page before launch.

Scanned PDFs are the only case where a statement leaves your device. You decide each time.

How the site is locked down

• A strict Content Security Policy. Pages can only run code and load files from Tableaf’s own domain, and can only open connections back to it. Plugins and framing are blocked.
• No third-party scripts. No tag managers, ad scripts, chat widgets or social buttons. The fonts are served from our own domain too.
• HTTPS only. The site tells browsers to always use HTTPS.
• Works offline. After your first visit, the converter keeps working without a connection. That is also a quick way to confirm nothing needs to be sent.
• Open-source building blocks. The libraries we ship are listed on the open source page.

None of this makes a site invulnerable. It closes the usual ways data leaks, and the rest is care and quick fixes.

Subprocessors

These companies handle data for us: Cloudflare for hosting, the database and analytics; Resend for sign-in emails; and Dodo Payments as the merchant of record for payments. An OCR provider will be added before scanned PDFs go live. The subprocessors page says what each one receives and where.

For accountants and tax preparers

If you are a tax preparer, CPA firm or bookkeeper in the US, the FTC Safeguards Rule asks you to oversee the service providers that touch your clients’ data. This section is information for your own assessment. It is not legal advice, and your firm remains responsible for meeting the rule.

The short version: because text PDFs never leave your device, the converter adds no new place where client data is stored.

• Text PDFs: read and converted in your browser. We never receive the statement, so we hold no client data to protect, retain or delete.
• Our records: your email address, plan, page counts and sign-in sessions. None of it is client data. See what we store.
• Scanned PDFs, once live: the one exception. Each file needs a consent click, goes to a named provider, and is deleted within 1 hour. If your engagement terms or your own policies don’t allow a client’s file to go to a provider, don’t click through.
• Providers: the full list is on the subprocessors page.
• A named contact for security questions: see below.

If your written information security program needs a statement about Tableaf, you are welcome to quote this page. Email security@tableaf.com if you need something more specific.

Report a security issue

If you think you have found a vulnerability, please email security@tableaf.com. We read every report and reply within 1 working day.

What helps

• What you found, the page or file it affects, and the steps to reproduce it.
• What you think an attacker could do with it.
• Whether you want to be credited when it is fixed.

Please

• Give us a reasonable time to fix the issue before you share it.
• Use your own account and your own test files. Don’t access other people’s data.
• Don’t run attacks that degrade the service for others, and don’t use social engineering against us or our providers.

If you follow these rules in good faith, we won’t take action against you for your research. We don’t run a paid bounty program, but we will thank you and credit you if you wish.

Not a security matter? See the contact page.