# Security and data retention

> What happens to a statement you send, what we keep, and for how long.

Section: Platform
Source: https://statementbear.com/docs/security
Product: StatementBear statement parsing API, $0.49 per document, 25 free.

---

The API stores no transactions. A statement is parsed and returned, and your system is the record.

## What happens to a PDF you send

It is read, parsed, and dropped when the response is written. It is never written to disk, put in storage or attached to an account.

## What we keep

| Kept | Why | For how long |
| --- | --- | --- |
| A usage row per request: timestamp, status, error code, byte size, duration, issuer name, account count, row count, and the filename if you sent one. | Invoices are settled from it. | The life of the account. |
| The response body behind an `Idempotency-Key`. | So a replay can be honoured instead of re-parsed and charged twice. | 24 hours, then deleted automatically. |
| A hash of each API key. | To authenticate you. The key itself is never stored. | Until the key is revoked. |

> **The row count is a count**
>
> The usage log records how many transactions a document held. It does not record what they were. No merchant name or amount from an API call is stored anywhere.

## Idempotency replays

A stored replay body is the only place the API holds transactions at rest. It is kept apart from the billing record and deletes itself after 24 hours.

## Transport and access

- TLS on every request. The endpoint is not reachable over plain HTTP.
- Keys are long random strings, stored hashed, and revocable by you at any time. See [Authentication](https://statementbear.com/docs/authentication).
- Issuing a key and raising a cap are both recorded on our side.
- The person whose statement it is has no account here and is never contacted by us.

## AI processing

Reading a statement uses an AI model, and the statement's text is processed by our model provider to do it. Nothing else leaves our infrastructure, and the PDF does not. We train nothing on your documents. Email [api@statementbear.com](mailto:api@statementbear.com) if your compliance review needs the provider named and its data processing terms.

## Deletion

There is no transaction data to delete. Usage rows can be removed on request, though they are what an invoice is explained from. Email [api@statementbear.com](mailto:api@statementbear.com).

---

All documentation: https://statementbear.com/docs/llms.txt
Questions: api@statementbear.com