Questions to ask before uploading client bank statements

A bank statement carries account numbers, balances, payroll, rent and the names of everyone the business pays. When you send a client's statements to a conversion service or tool, you are passing that on. Bookkeepers often warn each other not to feed client data to a converter they know nothing about, and that is sound advice.

The fix is not to avoid tools. It is to ask a few plain questions first and keep the answers with your workpapers. This checklist works for any converter, whether it is a website, a desktop app, a browser tool or a person you hire.

1. How are the files protected?

• In transit: is the upload sent over HTTPS (TLS)? Check for the padlock, and be wary of any service that asks for statements by plain email attachment.
• At rest: are stored files encrypted, and when does that happen? "Encrypted" means more if they say when and how, for example before anything is written to storage.
• Who holds the keys? If the hosting provider or every staff account can decrypt the files, encryption protects less than it sounds.

2. Who or what can see the files?

• Are statements read by software only, by people, or both? If people, are they employees or outside contractors, and in which country?
• Is any third-party service (a cloud AI, an OCR service, an outsourced review team) sent the files? If so, which ones, and under what terms?
• Are files ever used as examples, demos or samples on the website?

3. How long are files kept, and how does deletion work?

• How long are the uploaded statements kept? And the outputs (CSV, QBO, Xero files)? They are often handled separately.
• Is deletion automatic on a fixed schedule, or only when someone remembers?
• Are backups, email copies and download links covered by the same schedule?
• Is each deletion logged, and can they tell you when your files were deleted?

4. Is the data used to train models?

• Ask directly: are statements or extracted transactions used to train or improve any AI model, theirs or a vendor's?
• Is the answer written in their privacy policy, or only said in a chat? Get it in writing.
• Is it an opt-out setting that you have to find and turn off, or simply never done?

5. Where is the data processed?

• Which hosting or cloud providers are involved, and in which countries are files stored and processed?
• Does any of that matter for your engagement letter, your client's industry or your own firm's policies?

6. How do you get the files back?

• Do you need to create an account and password, or is there a one-time private link or code?
• How long does the download link work, and what stops someone else from using it?
• Are outputs emailed as attachments? An attachment sits in two mailboxes indefinitely.

7. What happens to uploads that never become an order?

Many people upload one statement to try a service and never come back. Ask what happens to those files. Are they deleted on a schedule, kept indefinitely, or kept "for quality purposes"?

8. How do you ask for deletion?

• Is there an email address or form for deletion requests, and how quickly do they act?
• Do they confirm when it is done?

9. What can you strip or redact first?

• Most conversions only need dates, descriptions, amounts and the opening and closing balances.
• You can usually black out full account numbers, the account holder's address and any check images before uploading. Use a tool that removes the text, not one that only draws a box over it.
• Send only the months and accounts you need converted, not the whole download folder.

10. Do you have the client's permission?

• Only the account holder, or a bookkeeper or accountant acting for them, should be sending their statements anywhere.
• Check that your engagement letter covers using outside services to process client records. If it is unclear, ask the client before you upload.
• Keep a short note of which service you used, for which months, and when the files were deleted.

How LedgerReady answers these

Every answer below uses the wording already on our privacy note and about page. Where those pages don't answer a question, we say so.

Statements sent by email are stored encrypted the same way and then kept with our correspondence, so please use the upload form instead, or ask us to delete emailed files. Full detail: how we handle your files.

For what to check once the files come back, see check a statement is complete before you import it.

Bank menus change; labels here were accurate to our knowledge in Oct 2026, so check your bank's help pages if something differs.