Every number in your ledger traces to a source you chose to connect — nothing is scraped, guessed, or bought. Here's each channel, exactly what it carries, and the protections wrapped around it.
EOB uploads: drag insurer PDFs (or phone photos) in; text is read locally on our server — scanned documents go through built-in OCR that never leaves the machine. Statements: CSV/OFX exports from your bank's website; parsed on arrival, never sent anywhere. Email-in: forward an EOB to your private docs-address; the message is authenticated by a shared secret before a byte is processed. In every case the original file is stored encrypted (AES-256-GCM) with a SHA-256 fingerprint recorded at the moment of upload — the packet can later prove the file is byte-identical to what you submitted.
Bank & card (Plaid): you sign in at your bank's own screen — your credentials never touch HSAMatch; we receive read-only transaction data (date, merchant, amount) and the access token is stored encrypted. We read; we can never move money. Insurance (Flexpa): patient-authorized claims access under the federal Patient Access rule — your insurer's adjudications arrive as structured FHIR data with the payer's verbatim payload preserved as evidence. Medicare (Blue Button): the same consent pattern, run by CMS itself. Disconnect any of these in one click; what's already documented stays yours.
Encrypted documents at rest; scrypt-hashed passwords; optional two-factor authentication; strict browser protections; per-account isolation (every request checks ownership); and an append-only, hash-chained event log — any tampering breaks the chain detectably, and the audit packet verifies the chain in front of whoever reads it. If you link an advisor or CPA they see summary numbers and status only, never documents, revocable instantly.
We never see or store bank passwords. We never sell, share, or monetize your data — the business is subscriptions, full stop. We never lock you in: every export works on every plan, originals byte-identical, and deletion is deletion.
Free plan includes every export, forever.