Private by architecture.
Financial documents deserve narrow access, short retention, and controls that can be explained without hand-waving.
Private files
Statements and exports are stored in private Supabase buckets. Downloads require an ownership check and use a short-lived signed URL. Service credentials stay on the server.
Document processing
Production extraction sends Mistral OCR a short-lived signed URL to the private source PDF. Raw document URLs, statement content, and annotation payloads are not written to application logs; automated tests use sanitized fixtures.
Deterministic verification
OCR annotations are schema-validated, but arithmetic is checked in application code with decimal math. Checking, debit-card, savings, prepaid, stored-value, and credit-card transactions all carry a normalized balance effect.
Retention and deletion
A scheduled cleanup removes expired source files, exports, and conversion rows. Account holders can delete individual conversions immediately.
What verification does not mean
Balance verification proves that available arithmetic controls reconcile within one cent. It does not guarantee semantic perfection, replace accounting judgment, or provide human review.