Security
Your statements never leave your computer
This page explains, in plain terms a partner or a client can follow, how KhataSheet converts statements without uploading them, what does reach our server, and how you can check every claim yourself.
At a glance
Processed in your browser
The converter is JavaScript that runs in your browser tab. The PDF is opened there, read there and turned into Excel or XML there.
Blocked from other sites
A Content-Security-Policy stops the page from talking to any website other than our own.
No accounts, no cookies
Nothing to log in to, no tracking cookies, no ads. Settings stay in your browser's storage.
Works offline
Once the page has loaded, you can switch Wi-Fi off and still convert a statement.
How a conversion works
- You choose a PDF. The browser gives our page the file's bytes in memory. Nothing is sent anywhere.
- pdf.js reads the text. pdf.js is the open-source PDF engine used by Firefox. It runs in a background worker inside your browser. If the PDF is locked, the password you type is passed to pdf.js and then discarded; it is never stored or sent.
- Our parser finds the table. It locates the header row (Date, Narration, Debit, Credit, Balance and so on), reads every row, joins wrapped narrations and converts amounts to whole paise so there is no rounding drift.
- The balance check runs. Opening balance + credits − debits must equal the closing balance, and every running balance must match. Rows that do not are flagged; nothing is changed silently.
- The files are built on your device. Excel, CSV and Tally-compatible XML are generated in the browser and saved straight to your Downloads folder.
What does reach our server
| The page itself | Your browser downloads the website (HTML, JavaScript, fonts) from Cloudflare Pages, like any website. |
|---|---|
| Anonymous counts | Small events such as "conversion succeeded, SBI format, 48 rows, balance check passed". No file, no transactions, no amounts, no names, no account numbers, no IP address stored. Every field is listed and you can switch counting off. |
| Error reports | If our code crashes: the error type, the line of our code and the browser family. Never file contents. Details. |
| Things you choose to send | Only when you click it: feedback notes, contact-form messages and attachments, a launch-updates e-mail address, or a statement you choose to send with Send us this statement. That button opens a consent window first, sends an unlocked copy but never your password, and the file is deleted after 30 days. Details. |
| Optional AI features | Off. If ever switched on, they always ask first and say exactly what is sent. |
Verify it yourself in one minute
- Open the converter in Chrome or Edge and press F12 (or right-click → Inspect), then open the Network tab.
- Convert a statement (or a synthetic sample).
- Look at the requests. You will see the page's own files and one tiny
/api/eventrequest. Click it: the payload is a handful of labels and counts. There is no request carrying your PDF. - For extra certainty: load the page, turn off Wi-Fi, and convert a file. It still works, because there is nothing to upload.
Browser protections we set
Every page is served with these security headers:
- Content-Security-Policy:
default-src 'self'; script-src 'self' 'unsafe-inline' 'wasm-unsafe-eval'; worker-src 'self' blob:; connect-src 'self'; object-src 'none'; frame-ancestors 'none'.connect-src 'self'means the page physically cannot send data to another domain. - Strict-Transport-Security: HTTPS only.
- X-Frame-Options: DENY and
frame-ancestors 'none': other sites cannot embed KhataSheet to trick you. - Cross-Origin-Opener-Policy, X-Content-Type-Options: nosniff, a strict Referrer-Policy and a Permissions-Policy that disables camera, microphone and location.
What stays in your browser
Your ledger rules, theme and this month's page count are kept in your browser's local storage on this computer. They are not cookies and are never sent to us. Clear them any time by clearing site data for KhataSheet in your browser settings. You can export your ledger rules to a file to move them to another computer.
See the output before you trust it
These files were produced by KhataSheet from our synthetic sample statements (made-up data in each bank's layout). Open them in Excel or import them into a test company in TallyPrime.
The matching PDFs: SBI sample PDF, HDFC sample PDF.
Infrastructure
- Hosting: Cloudflare Pages (static files on a global CDN). Server functions only receive anonymous counts, error reports and messages you choose to send.
- Database: Cloudflare D1, holding only those counts and messages. It has no column that can store a statement.
- Code changes are reviewed and run through an automated test suite (balance checks, Tally XML, every sample bank layout) before each release.
Report a security issue
If you find a vulnerability, please tell us privately through the contact page. We will acknowledge within 48 hours and fix confirmed issues as a priority. Please do not test against other people's data.