Security and data privacy

Is it safe to upload bank statements?

It's the right question to ask of any tool. Here is exactly what SandQuery does.

Who can see your data

• Report authors never see your data or your results. They see that a run happened: when, whether it worked, and whether it was free or paid. Once enough owners have rated a report, its author sees the ratings grouped together. You see how a report works only if its author chooses to share it.
• Shared result links are opt-in. You can revoke a share link or reset it (the old URL stops working). Share links are kept out of search engines and out of referrers.
• Reports run in an isolated sandbox. A report can't see your other files, reach the network, or touch anything else on the server.

How files are handled

• Files upload straight to object storage (Cloudflare R2, Eastern North America) through signed links that expire within hours. Cloudflare encrypts everything stored in R2 at rest.
• The app runs on Railway behind Cloudflare, and requests that don't come through Cloudflare are refused. The database is Postgres on Neon; background jobs queue on Upstash Redis.
• PDFs and photos are read with an AI model. An extraction service on SandQuery's private network pulls out the text or page images, and a model reads them into rows. The models are self-hosted, with OpenRouter as a fallback.

Stripe connection

Connect with Stripe OAuth, or paste a restricted key. SandQuery only asks for read access: it can't create charges, move money or change your Stripe account. It syncs payouts, charges, refunds, disputes and balance transactions when you ask, on a schedule you turn on, or when Stripe reports a change. Disconnecting pauses the connection and clears the stored credentials; data already synced stays on your account until you delete it. Uninstall the app in the Stripe Dashboard to revoke access at Stripe.

Retention

• Uploaded files: the rows read from a file stay until you delete them.
• Synced data is kept as versions. Recent versions, and any a run, schedule or set still relies on, are kept; older ones are deleted.

Monitoring and analytics

• Errors go to Sentry without request bodies, cookies, headers or query strings, identify you by user ID only, and have IDs and tokens masked in URLs.
• Product analytics go to PostHog: named events only (such as joining the waitlist or opening a report), tied to your user ID once you sign in. Nothing is recorded from your session on its own, and tokens in links are removed before anything is sent.

FAQ

Can I delete my data?

Yes. Delete any dataset, revoke share links, and disconnect Stripe (its stored credentials are cleared at once).