What happens to a document you upload.
You are handing us bank statements. That is a reasonable thing to want answers about before you do it. This page states what the system does, including the parts that are not finished yet.
Where a document goes
Four steps, in order. Everything happens inside our own Azure subscription in the United States.
-
You upload a file, or forward it, or a client posts it to your portal
The file goes straight to private blob storage in our Azure subscription. Containers are private, public access is turned off, and the connection is TLS 1.2 or better. Nothing is served from a public URL.
-
A worker reads it page by page
Extraction runs on an Azure AI Foundry model deployment inside our own Azure resource, reached with a managed identity rather than a key. The document is sent to that deployment and nowhere else.
-
The rows are checked against the document
For statements, LedgerBox sums the rows it extracted and compares them to the statement's own opening and closing balances. It flags anything it cannot verify instead of returning it as certain.
-
The result is stored in our database, and you export it
Extracted rows are written to our Postgres database in the same region. You export them as Excel, CSV, QuickBooks CSV, QBO, or JSON, or post them to QuickBooks Online.
We do not train models on your documents
LedgerBox does not train, fine-tune, or evaluate any model on customer documents. There is no training pipeline that reads your data, because there is no model of ours to train: extraction runs on a Microsoft-hosted model deployed inside our own Azure resource.
That makes Microsoft's terms the ones that matter, and they are published. Microsoft states that prompts and completions are not available to OpenAI, are not used by model providers to improve their models or services, and are not used to train foundation models without your instruction.
“The models are stateless: no prompts or completions are stored in the model. Additionally, prompts and completions are not used to train, retrain, or improve the base models.”
Microsoft Learn, data privacy for models sold by Azure checked 2026-08-21
Nobody at LedgerBox reads your documents
There is no human review step in the pipeline. LedgerBox does not employ or contract reviewers, onshore or offshore, and no company in the subprocessor list below performs document review of any kind. When LedgerBox cannot read something, it flags the row for you to check. It does not send it to a person.
One qualification, because leaving it out would make the paragraph above sound broader than it is. Microsoft runs abuse monitoring on the service extraction uses. Automated checks run on every request and store nothing. If those checks flag a pattern as potentially abusive, a sample can be stored and reviewed by authorized Microsoft employees. That is Microsoft's control, not ours, it applies to every customer of the service, and it is documented.
Microsoft Learn, abuse monitoring checked 2026-08-21
Retention and deletion
What the system does today, rather than a policy we would like to have.
- There is no retention window
- LedgerBox does not delete your documents on a timetable. A document stays until you remove it. No plan buys a longer window than another, because there is no window: retention is not a feature we sell.
- Deleting removes it from your workspace at once
- Delete a document and it leaves your workspace immediately: it stops being readable, exportable, and countable in the app, for every member of your organization.
- Erasing the stored file is a request
- Deleting in the app does not itself erase the file from storage. Write to contact@ledgerbox.io and we erase the file and its extracted rows. We would rather say that plainly than describe an automatic purge that does not run.
- Client portal files can expire
- The client portal is the one place with a retention control. Set a window in Settings, Client portal, and a sweep erases the uploaded file once a document has been processed. The extracted document, which is your actual work product, is never touched by it.
Who else processes your data
The full list, and specifically what each one sees. It is the same list the privacy policy publishes, read from one file so the two cannot drift. Effective 2026-07-27.
| Company | What they do | What they see | Where |
|---|---|---|---|
| Microsoft Azure | Hosting, storage, databases, and AI document extraction | Uploaded documents, extracted data, and account records | United States (East US) |
| Clerk | Accounts, sign-in, and session management | Email address, name, and authentication metadata | United States |
| Stripe | Payments, subscriptions, and usage billing | Billing contact, plan, and usage counts. Card details go to Stripe directly and never reach our servers | United States |
| Resend | Transactional and marketing email delivery | Email address and message contents | United States |
| Intuit (QuickBooks Online) | Sending extracted transactions, only if you connect the integration | The transactions you choose to send | United States |
| PostHog | Product and marketing analytics | Usage events and device metadata. The event taxonomy is an allowlist, so document contents cannot be captured | United States |
What we do not have
A trust page that only lists what a company has is an advertisement. These are the things a careful buyer will ask for and we cannot hand over today.
- No SOC 2 report
- LedgerBox does not hold a SOC 2 Type I or Type II report. If your firm requires one before it can use a vendor, we cannot meet that requirement today, and one of our comparison pages names a competitor that can.
- No signed data processing agreement on the site
- There is no self-serve DPA to download. Write to contact@ledgerbox.io if you need one and we will handle it directly.
- No single sign-on
- Accounts are email and password or a social login through Clerk. There is no SAML or SCIM, on any plan, and no plan page claims otherwise.
- No published accuracy number
- LedgerBox does not publish an accuracy percentage anywhere, on purpose. A single number across every institution and layout would not mean anything for your documents. The reconciliation check and the flagged rows are what we offer instead: the product tells you which rows it could not verify, on the document itself.
The rest of it
The privacy policy is the binding version of everything above. The terms cover the contract, and cookies covers the site itself. Billing questions are answered on pricing, and the comparison pages hold the sourced version of how we stack up. Anything else, write to contact@ledgerbox.io.