Kederi stores no transactions

What is stored

No transactions, at all. Enrichment is computed and forgotten: the answer goes back in the response and nothing is written down.

An account_id in a request only groups the transactions of that request. It causes nothing to be kept.

We store your account: an email address and a password hash. We also store your API keys, how much you called so that a bill can be checked, and any correction you send on purpose.

Some counters are kept too. None of them holds a file, a row or a narration.

Statements we could not read, and statements you imported in the console: the day, the file type, and the reason or the row count.

Playground lookups and playground reports: a keyed hash of your network address, the minute or the day, and a count. A report is one click on “Is this answer wrong?”.

Sign-in attempts, by the address you typed, so that ten wrong passwords in one window of ten minutes stop sign-in for that address until the window ends.

A password reset link that waits for use. We keep a hash of the link, its account, and three times: when it was made, when it expires and when it was used. The link itself is not stored. We send it to your address with Cloudflare Email, and it works once, for 30 minutes.

A message from the contact form is not stored. We send it to our inbox with Cloudflare Email, with your address as the one to answer. We keep the day, the topic you chose and a count, and nothing that you typed.

The sign-in counter is deleted after a day, a reset link when it expires, and the other counters after 90 days. That is the list.

Where your history lives instead

On your machine.

The reports that need history (subscriptions, duplicates, the cash-flow forecast, counterparties, anomalies, the fee audit) take the transactions in the request and return the answer. You keep the rows; we compute over them and forget them.

The console does exactly that: it parses your statement in your browser, keeps the rows there, and sends them up only to have a report computed. Nothing about it reaches a database of ours.

Why this matters more than a retention policy

There is no retention window, because there is nothing to retain.

A bank narration frequently names somebody who is not you: the person you paid, because that is what the sending bank wrote. They never agreed to anything and cannot be told. A retention policy manages that; holding nothing removes it.

A promise about how long we keep your data is only as good as the keeping. This page can make a simpler claim instead: there is nothing to keep, and no window to enforce.

Request logs

Request bodies are not captured, and nothing logs a descriptor.

Filters that can name a person travel in the request body rather than the URL, because URLs are logged and bodies are not. Narrowing a report by free text or by counterparty name is a POST for that reason alone.

Cookies

This site sets no analytics cookie and no third-party cookie.

The product sets one cookie when you sign in: a session cookie, httpOnly and SameSite=Strict, holding a random session token and nothing else. We store only a hash of that token. Page scripts cannot read the cookie.

The playground sets a second one, the first time it looks something up: a pass that shows the check below was passed. It lasts one hour and is sent only to the playground. It holds a time and a signature, and no id, no address and nothing you typed. We store nothing for it.

Both cookies are strictly necessary, so there is no consent banner. If we add an analytics or advertising cookie, this section changes and a consent control comes with it.

Signing out deletes the stored session as well as the cookie. A session that is not deleted ends when it expires.

Third parties

No model sits on the enrichment path.

A request makes no call to any model provider. Enrichment is rules plus a dictionary, and it runs in one place.

The public pages load one outside script: Cloudflare Web Analytics. These are home, how it works, coverage, pricing, the FAQ, about, narration formats, the terms and this page. It counts page views and load times. Cloudflare states that it sets no cookie, uses no local storage and does not fingerprint a visitor. It does not record the query string of a page address.

Our security policy refuses that script on the console, the playground, the API reference, the sign-in pages and the admin page, so it does not run where a statement, a narration you type or a key is on the screen. Cloudflare already hosts this site and the API, so every request goes through its network.

The sign-up page, the page that sends a reset link, the contact page and the playground load a second Cloudflare script: Turnstile, a check that a person and not a script sends the form or makes the lookups. It runs on those four pages only. Our security policy refuses it everywhere else, and on the page where you choose a new password above all, because the link from the email is in that page. Turnstile sends Cloudflare what it needs to make the check, as Cloudflare's own privacy pages describe.

Your account

To close your account, or to ask what we hold about you, contact us.