Is it safe to upload bank statements to an online converter?
Sometimes, but you cannot tell from the front page. A statement holds your name, address, account number and a detailed record of how you spend money, and an upload puts a copy on a computer you do not control. Work through the checks below before you drop the file in.
What is actually on a bank statement
A statement carries your full name and home address, the account number, and the routing number or IBAN. Anyone who sees those details learns a lot about you.
Every line shows a merchant, a date and an amount: shops, a pharmacy, a clinic, subscriptions. Salary lines often show the employer. A year of statements is a fairly complete diary of how you live.
A bookkeeper's folder is worse. It holds the same data for every client, plus the clients' own customers and suppliers. That is why this question deserves more than a quick click.
What "upload" really means
When you drop a PDF on a web page, your browser sends the file to a server. The service reads it there and sends back a spreadsheet. During that time, and for as long as the service decides to keep it, a copy lives on someone else's disk.
You normally cannot see three things from the page: how long the copy stays, who inside the company or its suppliers can open it, and what else it is used for. Some services say "deleted after one hour". Some say nothing. A sentence on a website is a promise, not a lock, so you are trusting the people behind it.
The question to ask is not "is the site secure". It is "who is this company, and what are they allowed to do with my file".
The real risks, plainly
- Malicious or lookalike converters. In March 2025 the FBI's Denver office warned that criminals use free online document converters to load malware on victims' computers, as reported by Security Affairs. The tool may still return the converted file you asked for, but the result can contain hidden malware. Scan downloaded files and keep antivirus up to date. The same report says such tools can scrape uploaded files for personal data, banking details, emails and passwords.
- Unclear retention and deletion. If the policy does not give a period, assume the file stays. If it gives one, check that deletion is automatic and not something you must remember to request.
- Sharing with other companies. A privacy policy should say whether your data goes to third parties and who they are. The UK NCSC suggests asking a cloud provider whether it shares your data with third parties, and who they are.
- Use to train or improve a product. Some services say uploaded files may be used to improve their system. For a bank statement that is a bad trade, whatever the wording.
- Breaches. Any company that stores files can be broken into. The fewer copies exist and the shorter they live, the less there is to steal.
None of this means every online converter is bad. It means a free site with no named owner has not earned your statement.
Ten checks to do before you upload
Open the site in one tab and its privacy policy in another. Most answers are in the privacy policy; allow about ten minutes.
| Question | Good answer | Red flag |
|---|---|---|
| Who runs it? | A named company with a postal address and a way to write to them | No company name, only a contact form, or a name that differs from the domain |
| How long do you keep my file? | A stated period, such as hours or a few days | No period, or "as long as needed" |
| Is deletion automatic? | Yes, and the policy says so | You must email to delete, or deletion is not mentioned |
| Do you train on my files? | A plain "no" in the policy | Silence, or "to improve our services" |
| Where are files stored? | A named country or region | No answer |
| How do I request deletion? | A working address or form, with a stated reply time | Nothing, or a dead link |
| Who else sees my data? | A list of the types of third party, with names | "Partners" and "affiliates" with no names |
| Is there a data processing agreement for business use? | Yes, available to read before you pay | Not offered, or only "contact sales" with no detail |
| Does the page install anything or ask for a login to your bank? | No. You upload a file and download a result | It wants an .exe, an extension, or your online banking login |
| The padlock is there. Is that enough? | No. It only means the connection is encrypted | Treating the padlock as proof the owner is honest |
About that last row. Chrome's help page says information sent over a secure connection is private between you and the site, and still tells you to be careful with sensitive data. CISA explains that a valid certificate means an authority checked that the web address belongs to the organisation named, nothing more, and warns that attackers can fake a padlock icon.
Check the address letter by letter, in case it imitates another name.
A black box does not hide the text
Some people try to be careful: they draw a black rectangle over the account number and upload the result. In many PDF viewers and markup tools a rectangle is just a shape on top of the page, so the text can stay underneath. Test your own file with the steps below.
This is an old problem. A 2006 article on NSA guidance reports a government PDF where text had been blacked out and a simple copy and paste brought the hidden words back. NSA's advice listed placing a black rectangle over images among the things not to do, and told readers to check the final file for missed redactions. The article is about Word documents, but the principle is the same for PDFs.
- Open your "redacted" file and press Ctrl+A, then Ctrl+C.
- Paste into a plain text editor.
- Search for the account number. If it appears, it was never removed.
Proper redaction tools delete the content and not just cover it. If you do not have one, redaction is not the safe route. Choose another route from the next section.
Safer routes
- Download a CSV or similar file from your bank. Many banks offer it, though not all. You skip the PDF and nobody else ever has the file.
- Import in the spreadsheet program. Open the CSV in a spreadsheet program such as Excel, or import it with its text import option.
- Install a desktop converter. A desktop converter is a program on your own computer that reads the PDF there instead of on a web server. Read its privacy statement the same way you would a website's, and check what it collects.
None of these is perfect. A downloaded CSV can be incomplete. A desktop program still has an owner you must trust, and scanned pages need text recognition that not every tool offers.
If the statements are your clients'
A bookkeeper does not only risk their own data. The files belong to other people, who trusted you with them. Whether you may send them to a third-party service depends on your client agreement and on data protection rules in your country or region. This is not legal advice: read your agreement and check your local data protection authority's guidance.
A worked example, with invented numbers. You do the books for 12 clients and process 12 monthly statements for each, about 38 lines per statement. That is 144 files and 5,472 transaction lines. Suppose service A deletes files after one day and service B keeps them for 30 days. Assuming each file is deleted exactly at the end of its period, counting file-days, A holds 144 and B holds 4,320, which is 30 times more exposure for the same work. The numbers are made up, but the lesson holds: ask for the retention period, and multiply it by your batch.
A data processing agreement is a written contract that says what the service may do with the files. Whether you need one depends on where you and your clients are. Ask the service whether it offers one, and ask the authority where you work.
The bottom line
Some online services are run responsibly, by real companies with clear policies and short retention. We cannot tell you which ones, and we will not accuse any. What we can give you is the method: find the owner, find the retention period, find the third parties, and walk away if any of those is missing.
If the statement is your own and the service passes all ten checks, a quick upload is a risk you can decide to accept. If the statements are for clients, or you cannot answer the table, use a route where the file stays with you.
Questions
Is it safe to upload a bank statement to a free PDF converter?
It depends on who runs it, and a free site with no named owner and no retention period has not given you a reason to trust it. The FBI Denver office has warned about criminals using free document converters, as reported by Security Affairs in March 2025, so treat unknown sites with caution.
Does the padlock in the address bar mean the site is safe?
No. It means the connection between you and the site is encrypted. It does not tell you who owns the site or what they do with your file.
Can I hide my account number with a black box before uploading?
Not reliably. A rectangle drawn on top usually leaves the text underneath. Paste the text of the file into a text editor and search for the number to see if it is still there.
What should I check in a privacy policy?
Who the company is, how long files are kept, whether deletion is automatic, whether files are used to train a system, where they are stored, and which third parties receive data.
Do I need permission to upload my clients' statements?
That depends on your client agreement and your local data protection rules. Check both, or ask your local authority, before you send client files anywhere.
What is a safer way to get my transactions into a spreadsheet?
Download a CSV from your bank if it offers one, or use a desktop converter that reads the PDF on your own computer. Read the privacy statement of either.
Keep reading
More guides
About Ledgerpour
Ledgerpour is our Windows app that turns PDF bank and credit card statements that contain text into CSV, XLSX, QBO or CAMT.053 files, and checks that the balances add up before you import. It does not read scanned pages. Review the converted data before you use it in your books. It is not in the Microsoft Store yet.
Sources
- Security Affairs: report on the FBI Denver warning about free online document converters (March 2025)
- Route Fifty: NSA urges use of better redaction methods (2006)
- UK NCSC: lightweight approach to cloud security (reviewed 7 June 2023)
- Google Chrome Help: check if a site's connection is secure
- CISA: understanding website certificates (2021, archived)
Checked 2026-11-03.
Not affiliated with or endorsed by Microsoft or any bank. All product and company names are trademarks of their owners.