Bharat Balance

Bharat Balance

Security & trust

Bank statements are the most sensitive data you own. This page is maintained by the Bharat Balance team and explains, in plain language, exactly what we do with your data, what we deliberately never do, and what stays your responsibility.

Last updated: 29 July 2026

Encrypted in transit and at rest

Every request uses HTTPS/TLS. Your transactions live in a managed Postgres database with encryption at rest provided by the hosting platform.

Statement passwords never leave your device

Password-protected PDFs are unlocked inside your browser. The password is never sent to our servers and is never stored anywhere.

No statement files are stored

We do not keep your uploaded PDF, XLSX, CSV or TXT file. Only the transaction rows you explicitly confirm in the review step are saved.

Row-level security on every table

Transactions, people, aliases and uploads are all restricted by database policies to the account that created them. There is no shared or public read path to your data.

Server-side authorization

Reads and writes run through authenticated server functions that verify your session on the server. The browser cannot ask for another account's rows.

Delete on your terms

Delete a single transaction, a whole upload batch, or ask us to remove your account and everything in it.

What we never do

  • We never sell, rent or share your financial data with advertisers or data brokers.
  • We never ask for your net-banking login, card number, OTP, CVV or UPI PIN. Bharat Balance only reads statements you upload — it can never move money.
  • We never store the password of a protected PDF.
  • We never make your data readable by other Bharat Balance users.

How your upload is processed

  1. The file is read in your browser. Protected PDFs are unlocked locally.
  2. The extracted text is sent over TLS to our server, which uses an AI model to turn statement lines into structured rows. The file itself is never uploaded.
  3. You review every extracted row and untick anything you don't want.
  4. Only the rows you confirm are written to your account, protected by row-level security.

Statement text is processed to produce your results and is not used to train models by us.

Application security practices

  • Authentication: sessions are issued by a managed auth provider; passwords are hashed and never visible to us. Leaked-password checking is enabled on sign-up.
  • SQL injection: all database access goes through a parameterized client. We never build SQL by concatenating user input.
  • Input validation: uploads and filters are validated on both the client and the server, with type, size and length limits.
  • Cross-site request forgery: server functions run behind CSRF protection.
  • XSS: content is rendered through React escaping; we do not inject raw HTML from user data.
  • DDoS & network abuse: the app is served through a global edge network that absorbs volumetric attacks before traffic reaches the application.
  • Dependencies: packages are scanned for known vulnerabilities and updated.

Shared responsibility

We secure the application, the database policies and the hosting platform. You keep your account safe: use a strong unique password, don't share your login, and sign out on shared devices. Anyone with access to your email inbox can reset your password.

Honest limitations

Bharat Balance is an independent product. We are not a bank, and we hold no certification such as SOC 2, ISO 27001 or PCI DSS. Nothing on this page is an independent audit or a guarantee — it is a factual description of the controls we operate today. We would rather tell you that plainly than imply a badge we don't have.

Report a vulnerability

Found a security issue? Email support@bharatbalance.app with steps to reproduce. We'll acknowledge responsible reports and will not pursue action against good-faith research.

Security questions are always welcome.