Security and data handling

When you select an invoice CSV and a bank transactions CSV, the files are read by JavaScript running in the page. Parsing, column mapping, match scoring, allocation arithmetic and CSV export all run there. The data is held in memory for the session and is discarded when you refresh or close the tab, unless you explicitly ask us to keep the session on this computer. There is no upload endpoint, no server-side database of your financial data, and no bank or accounting-system connection. Accounts hold an email address only.

Two things can be written to your browser's IndexedDB, on your own machine. Neither is ever transmitted to us.

• Payer rules: the payer fragment from a bank description and the customer name you mapped it to, with a usage count. No amounts, invoice numbers, dates or memo text. Kept until you delete them.
• A saved session, only if you choose Keep it at import: the imported rows, column mapping, decisions and allocations, so a closed tab does not cost you an hour of work. Expires automatically after 30 days.

Use the control below — also available in the workbench footer — to delete all of it in one step. In private windows, or where storage is blocked, nothing can be saved and SettlePair degrades to memory-only behaviour.

Loading settlepair.com is an ordinary web request. Like any hosted site, the hosting and content-delivery infrastructure that serves the pages will normally produce technical server logs, which typically include information such as IP address, timestamp, requested path and user agent. Public pages also load a web font from Google Fonts, which is a request to that provider. None of these requests carry the contents of your reconciliation files.

• Use a device and browser profile you trust, kept up to date.
• Be careful with browser extensions — an extension with page access can read what is on screen in any tab, including this one.
• Avoid shared or public computers for financial exports.
• Delete the downloaded settlepair-reconciliation.csv when you have posted it to your books; from the moment it is saved it is a file on your disk.
• Restrict your bank export to the statement period you need, rather than exporting everything.
• Close the tab when you finish; that clears the in-memory session, and use 'Clear everything stored on this device' if you also saved one.

Browser-local processing removes a whole class of risk, but it is not absolute security, and we do not claim it is. In particular:

• We cannot protect data on a compromised device, or against malicious browser extensions, keyloggers or screen capture.
• Files you export are outside the browser and outside our control.
• There is no encryption-at-rest story to describe because there is no server-side store of your reconciliation data; anything saved locally rests on your device with whatever protection that device provides.
• SettlePair is an early-stage product. We make no claim of certification, audit, formal compliance programme or uptime commitment.
• No software is free of defects. Treat the output as a review aid, not a verified result.

If you believe you have found a security issue, email support@settlepair.com with the subject line "Security report". Please include what you found, the steps to reproduce it, the affected page or file, and your assessment of the impact. Send it privately rather than posting it publicly, and give us a reasonable opportunity to look into it.

Please keep testing non-destructive: no denial-of-service, no automated scanning that degrades the service, no social engineering, and no access to data that is not yours.

SettlePair does not run a bug bounty programme and does not pay for vulnerability reports. We also do not offer legal safe harbour for security testing. Nothing on this page grants permission to test the service, and any testing you carry out is at your own risk and remains subject to the Acceptable Use Policy, unless we agree otherwise with you in writing beforehand.

Security questions and reports: support@settlepair.com. General questions belong on the contact page.