Security and data handling

When you select an invoice CSV and a bank transactions CSV, the files are read by JavaScript running in the page. Parsing, column mapping, match scoring, allocation arithmetic and CSV export all run there. The data is held in memory for the session and is discarded when you refresh or close the tab. There is no upload endpoint, no database, no account, and no bank or accounting-system connection.

Loading settlepair.com is an ordinary web request. Like any hosted site, the hosting and content-delivery infrastructure that serves the pages will normally produce technical server logs, which typically include information such as IP address, timestamp, requested path and user agent. Public pages also load a web font from Google Fonts, which is a request to that provider. None of these requests carry the contents of your reconciliation files.

• Use a device and browser profile you trust, kept up to date.
• Be careful with browser extensions — an extension with page access can read what is on screen in any tab, including this one.
• Avoid shared or public computers for financial exports.
• Delete the downloaded settlepair-reconciliation.csv when you have posted it to your books; from the moment it is saved it is a file on your disk.
• Restrict your bank export to the statement period you need, rather than exporting everything.
• Close the tab when you finish; that clears the session.

Browser-local processing removes a whole class of risk, but it is not absolute security, and we do not claim it is. In particular:

• We cannot protect data on a compromised device, or against malicious browser extensions, keyloggers or screen capture.
• Files you export are outside the browser and outside our control.
• There is no encryption-at-rest story to describe because there is no server-side store of your reconciliation data; that is the design, not a guarantee about your machine.
• SettlePair is an early-stage product. We make no claim of certification, audit, formal compliance programme or uptime commitment.
• No software is free of defects. Treat the output as a review aid, not a verified result.

If you believe you have found a security issue, email support@settlepair.com with the subject line "Security report". Please include what you found, the steps to reproduce it, the affected page or file, and your assessment of the impact. Send it privately rather than posting it publicly, and give us a reasonable opportunity to look into it.

Please keep testing non-destructive: no denial-of-service, no automated scanning that degrades the service, no social engineering, and no access to data that is not yours.

SettlePair does not run a bug bounty programme and does not pay for vulnerability reports. We also do not offer legal safe harbour for security testing. Nothing on this page grants permission to test the service, and any testing you carry out is at your own risk and remains subject to the Acceptable Use Policy, unless we agree otherwise with you in writing beforehand.

Security questions and reports: support@settlepair.com. General questions belong on the contact page.