A bank statement shows your name, address, account details, income and every place you spend money. Uploading one to a website you found five minutes ago deserves a minute of checking first. These are the questions worth asking any converter, the safer alternatives when the answers are not good enough, and how Sonomir answers each one.
What is actually at risk
Be specific about the risk, because it decides how careful you need to be.
A statement usually contains your full name and address, the bank's name, a full or partial account number, sort code or routing details, your balance, your salary or other income, and a detailed record of where you shop, who you pay and when. Someone holding it cannot normally move money with it alone, but it is very useful for impersonating you, for targeted phishing ("we noticed a payment to…"), and for building a picture of your finances.
So the questions to ask are: who receives the file, how long it is kept, whether anyone else can see it, and whether it is used for anything beyond your conversion.
Eight questions to ask any converter
- Who runs it? Is there a named company or person, a contact address and terms? An anonymous site with no way to reach anyone is a reason to stop.
- Where does the file go? Is it processed on your own computer, or uploaded to a server? If uploaded, which services read it: the site's own code, an OCR provider, an AI model provider?
- Is the upload deleted, and when? "Deleted after processing" is a specific promise; "kept to improve our service" is not.
- How long is the result kept, and can you delete it? The extracted transactions are as sensitive as the PDF.
- Is your data used to train models? Look for an explicit statement about the providers that read the file, not just the site itself.
- Who else can open your result? A result reachable by a guessable link, or shared across users on the same network, is a leak waiting to happen.
- What happens to a password for a locked PDF? Ideally it never leaves your device.
- How do you pay? A recognised payment processor or merchant of record means your card details never reach the converter itself.
A legitimate service answers all eight on a page you can read before uploading. Vague answers, or none, are the real warning sign; a certificate or a long list of logos is not a substitute for specific answers.
Signs a converter is not worth the risk
- It asks you to sign in to online banking through it, or for your banking password. A file converter never needs either.
- It demands your full card details for a "free" conversion.
- The privacy policy says uploads may be kept indefinitely, shared with partners, or used to improve products, with no opt-out.
- There is no contact address, no company name and no terms.
- Results are delivered by a link that anyone could open, with no expiry.
- The site pressures you with countdowns or claims you cannot verify.
Safer alternatives, when the answers are not good enough
Sometimes the safest converter is no converter.
- Your bank's own export. Online banking often lets you download transactions as CSV, OFX or a QuickBooks file. Nothing leaves the bank except to you, and nothing is misread. See how to extract a bank statement.
- Excel's Get Data from PDF. Microsoft 365 Excel on Windows reads tables from a text PDF on your own computer. It does nothing with scans.
- Your accounting software's own import. QuickBooks Online and, for eligible US and Canadian organisations, Xero can read PDF statements themselves, inside a service you already trust with your books.
- Desktop converters. Some paid converters, such as ProperSoft's, run entirely on your own computer, so the file never leaves it. If your rules forbid sending statements to a cloud service, that is the better choice.
A cloud converter makes sense when the file is a scan, when the bank cannot help, or when you want a result checked against the statement's balances. It is a trade-off, and you should make it knowingly.
How Sonomir answers those questions
Every point below is checked against the code and set out in full on how your files are handled.
- Who runs it: Sonomir is a small independent product built and run by one person, named on the about page. Email reaches a person, and the contact page says how to ask for everything about you to be deleted.
- Where the file goes: your browser sends it to private storage at Supabase over an encrypted connection. Bank statements are read by Google's Gemini models on Vertex AI, Google Cloud's paid business service, whose terms say customer data is not used to train its models without permission.
- Deletion: the uploaded file is deleted from storage when the job ends, whether it succeeded or failed.
- The result: kept for 24 hours by default, or 30 days if you choose before starting, so downloads still work. A "Delete this result" button removes it sooner. Only the last four digits of an account number are kept.
- Who can open it: only the browser that made it, or your account once you sign in. Nothing is published.
- Passwords: a locked PDF is unlocked in your browser, and the password is never sent.
- Payment: checkout is run by Dodo Payments as merchant of record; card details never reach Sonomir.
What Sonomir does not offer: local processing, an audit certificate such as SOC 2, or a direct bank connection. If you need any of those, one of the alternatives above is the better fit.
Checking the result is part of safety too
A converter can be perfectly private and still get a digit wrong. A missed or misread transaction in your books is its own kind of risk, especially for tax returns and loan applications.
Whatever you use, check that opening balance plus money in minus money out equals the closing balance, and compare the row count and a few transactions with the original. Sonomir runs those balance checks automatically and flags the rows where a running balance breaks; a passing check shows the amounts agree with the printed balances, not that every date and description is right. Our guide to converting a bank statement PDF to Excel explains how to do the checks by hand. When you are done, delete the result and any downloaded copies you no longer need.
Questions
- Is a bank statement converter legit?
- Many are. A legitimate one names who runs it, says exactly where your file goes, deletes uploads on a stated schedule, and never asks for your banking login. Check those before uploading.
- Can someone steal money with my bank statement?
- Not usually with the statement alone, but it gives enough personal and account detail for impersonation and targeted scams. Treat it as sensitive.
- Do converters keep my bank statement?
- It depends on the service; read its privacy page. Sonomir deletes the upload when the job ends and keeps the extracted result for 24 hours or 30 days, deletable sooner.
- What is the safest way to get a statement into Excel?
- Your bank's own CSV export, if it covers the period. Next, tools that run on your own computer. Use a cloud converter when those cannot read the file.
- Does Sonomir use my statement to train AI?
- No. Statements are read by Google's Gemini models on Vertex AI, whose terms rule out training on customer data without permission, and Sonomir does not train models.