Security

In the web app, payment spreadsheets, routing numbers, account numbers, and generated ACH files are processed only in browser memory. They are not included in server requests, URLs, analytics, logs, or error tracking.

The optional API and MCP server are the one exception: a request you send there necessarily carries its payment rows to the server. They are validated and turned into a file in memory, returned in the response, and not written to storage or logs. API keys are stored only as SHA-256 hashes and can be revoked from the account page.

Turso stores only account, session, purchase entitlement, API key hash, and export counter data. Optional bank profiles and column mappings use local browser storage and can be cleared by clearing site data.

Always verify recipient instructions independently and use your bank's required approval and test procedures.