StatementIQ — Zero-Retention Data Posture

StatementIQ processes bank and credit-card statements on hardware we own and operate. We do not store the documents you send us, we do not store the data we extract from them, and we do not use either to train models. Your document exists in server memory only for the seconds it takes to parse, and the extracted JSON exists only in the HTTP response we hand back to you. There is no third-party AI provider in the path — no OpenAI, no Anthropic, no Google, no AWS Textract — because the model runs on our own machine. Nothing about your statement leaves our hardware.

What that means, specifically

Question	Answer
Do you store the uploaded statement?	No. Never written to a database or object store. A PDF is written to a per-request temporary directory only so the PDF tools can read it; that file is overwritten with zeroes and the directory destroyed before the response is returned.
Do you store the extracted JSON?	No. It is built in memory and returned in the response.
Do you log request or response bodies?	No. The access log records method, path, and status code only. Account numbers, names, balances and transactions never reach a log line.
Do you train on customer data?	No. The model is a fixed local checkout. There is no feedback or fine-tuning loop that consumes caller data.
Who else sees the data?	Nobody. There are no third-party subprocessors for inference. Inference is on-premise.
What about async batch jobs?	Results live in process memory only, are dropped automatically after 15 minutes, and can be purged the instant you've read them with DELETE /v1/statement-parse/batch/{job_id}. They are never written to disk.
Is anything retained for billing?	Only the request counts our API marketplace meters for billing. No document content.
Can you produce my data if subpoenaed?	We cannot produce what we do not have. After the response is sent, there is nothing to produce.

The posture is also machine-readable: GET https://statements.carterstack.com/v1/privacy

Why this matters for lenders

Lenders, bookkeepers and fintech developers handling borrower financials are subject to the GLBA Safeguards Rule, which obliges them to oversee service providers that touch customer information. Sending borrower statements to a cloud AI vendor creates a vendor-management and data-flow problem you then have to document, justify and monitor. Every API competitor in this category is cloud-only.

A zero-retention, on-premise processor collapses that problem: there is no third-party data store to diligence, no retention schedule to negotiate, no training-use carve-out to read.

What this posture does not claim

Stated plainly, because overclaiming here would be worse than not claiming at all:

It is not a compliance certification. No SOC 2, no ISO 27001, no PCI attestation. We are describing our architecture and data handling, not presenting an audit.
It is not legal advice, and it does not by itself discharge your own GLBA, FCRA, state-privacy or contractual obligations. You remain responsible for your own program, including your own vendor diligence on us.
It does not cover the marketplace layer. If you call through an API marketplace, that marketplace sees request metadata under its own privacy policy. If you need that surface gone, use the direct or on-premise tier.
Transport and platform security are separate topics from retention. Traffic is HTTPS-terminated at the edge and the origin is not publicly addressable.
It is a statement of current practice, versioned with the service. Material changes get a version bump here.

The on-premise tier

For a bank or credit union that cannot send borrower financials off its own network at all, the same engine deploys inside your perimeter: your hardware, your network, no egress. That is a separate commercial conversation, and it is the tier this posture was really built to unlock.

Carterstack is operated by Alvin N. Carter, a licensed attorney whose practice includes BSA/AML compliance for banks and credit unions. This page describes how our software handles data. It is not legal advice and does not create an attorney–client relationship.

← Back to StatementIQ