Trust & Security

Your merchants’ data is handled like it matters. Because it does.

ScrublyIQ reads real bank statements for real merchants. Here is exactly how we protect that data, and how we grade the deals you run through it. Plain language, no asterisks.

Your data is protected

Identifiers stripped before AI processing

Social Security numbers, EINs, routing numbers, and account numbers are removed from statement text at every processing stage: and an automated release gate blocks any build where a planted identifier survives.

Encrypted at rest and in transit

Merchant identity and enrichment data are encrypted in the database with AES-256-GCM. All data moves over TLS, with HSTS enforced.

PDFs deleted on a 72-hour schedule

Your uploaded bank-statement PDFs are deleted by a scheduled retention job once they are 72 hours old; deletion is normally completed within 24 hours after that point. Raw statement text is never kept after processing. The one exception is a small, fixed set of statements we hand-select for accuracy testing of our extraction software, which is retained longer for that sole purpose. That testing does not train, fine-tune, or otherwise modify any AI or machine-learning model (see our Privacy Policy).

Account numbers minimized

Full account numbers are never stored: only the last four digits, as a masked identifier. Routing numbers are never stored.

Screened on every scan

Every analysis screens the merchant against the OFAC SDN list and runs PDF-metadata forensics plus balance reconciliation to catch tampering.

How ScrublyIQ tiers deals

ScrublyIQ reads a merchant’s statements and sorts the deal into a simple tier: A, B, C, or D, so you know at a glance where it stands before you shop it. Here is what each tier means in plain terms:

  • A

    Cleanest. Strong, consistent deposits, healthy balances, little to no negative activity. Best terms and the widest funder appetite.

  • B

    Solid, minor blemishes. Good fundamentals with a few small dings: an occasional low day or a slightly thin month. Fundable with most funders on solid terms.

  • C

    Real friction. Genuine issues: inconsistent revenue, negative days, or stacking pressure. Still fundable, but with fewer funders and tighter terms.

  • D

    High-risk. Serious red flags: heavy negatives, NSF clusters, or signs the file needs a closer look. Exception funders only, if at all.

This is how ScrublyIQ tiers a deal: not an industry standard or a funding decision. Every funder sets its own box, so treat the grade as a strong starting read on where a deal fits, not a guarantee of approval.

Security details

How ScrublyIQ protects your data, your merchants, and your business.

Data Security

  • Uploaded PDFs are deleted by a scheduled retention job once they are 72 hours old; deletion is normally completed within 24 hours after that point.
  • Exception: a small, fixed set of statements that we hand-select is retained beyond this window, indefinitely, for the sole purpose of internal regression and accuracy testing of our own extraction software. That testing measures whether the software still reads documents correctly; it does not train, fine-tune, or otherwise modify any AI or machine-learning model, and we do not use this data, de-identified or otherwise, to do so. These statements are kept in private, service-role storage that is never exposed to the application or to other brokers, are never shared, sold, or used for any other purpose, and are not something a broker can opt into or out of. Every statement outside this hand-curated set is deleted on the standard 72-hour schedule.
  • Within that same window, the merchant’s identity, the masked bank-account identifier, all third-party enrichment and verification results, and broker notes are permanently purged. A de-identified analysis record: date, status, risk tier, and an aggregated financial summary (monthly totals, ratios such as DSCR, the fundability score, and the underwriting narrative): is retained for the broker’s portfolio history. The raw statement documents and transaction-level detail do not survive this window.
  • Account numbers are never stored in full: only the last four digits are retained. Routing numbers are never stored.
  • Raw statement text is never persisted after extraction; it exists only transiently in memory during processing.
  • All uploaded statements are stored in private, encrypted Supabase storage: never on local disk and never publicly accessible. They are served only through short-lived signed URLs scoped to the authenticated broker.
  • Merchant names, business locations, and all enrichment data are encrypted at rest using AES-256-GCM before database storage.
  • All data is encrypted in transit using TLS (1.2 minimum; TLS 1.3 with modern clients).
  • HSTS (HTTP Strict Transport Security) is enforced with a 2-year max-age and preloading.
  • When bank statement text extraction requires additional processing, a temporary 60-second expiring link is used. Raw PDF content and financial data are never transmitted to external services.

Access Control

  • Authentication is provided by Clerk, a SOC 2 Type II certified identity provider. ScrublyIQ never stores broker passwords: credentials are managed entirely by Clerk.
  • Every endpoint that returns or accepts broker or merchant data requires an authenticated session. Nine machine endpoints (scheduled jobs, the Clerk and Stripe webhooks, and the background job runner) are authenticated by shared secret or cryptographic signature instead. The one endpoint that requires no authentication is a liveness check that returns no broker or merchant data.
  • Multi-factor authentication is available and recommended for all accounts.
  • Role-based access: organization administrators control member access and can suspend users with immediate session invalidation.
  • All data access is scoped to the authenticated user’s account or their organization.

Fraud & Compliance Screening

  • Every analysis automatically screens the merchant against the OFAC Specially Designated Nationals (SDN) list.
  • PDF metadata forensics run on every uploaded statement to detect post-creation modifications.
  • Statement balance reconciliation verifies mathematical consistency to detect edited transactions.
  • Duplicate statement detection prevents the same file from being analyzed twice.
  • Business verification data (name, address, registration number) submitted by brokers is shared with trusted verification partners including OpenCorporates, Melissa Data, UniCourt, Middesk, IRS TIN Matching, Smarty, and Google Places. Bank statement content, transaction history, account numbers, and financial records are never transmitted to any third-party service.

Infrastructure

  • Hosted on Vercel’s global edge network with automatic failover.
  • Database hosted on Supabase PostgreSQL with encrypted automated backups for disaster recovery, purged on a rolling cycle.
  • Row-Level Security (RLS) is enabled on all database tables.
  • Per-user and per-organization rate limiting via Upstash Redis distributed rate limiters covers 58 of our 67 API endpoints, which is every broker-facing route. The nine without it are the machine endpoints described under Access Control. A separate per-IP limit at the edge fronts every route except the liveness check and the signed payment and identity webhooks.
  • Audit logging captures all authentication events, admin actions, and data access.

Privacy

  • We do not sell, rent, or share your data with third parties for marketing purposes.
  • Bank statement PDFs are processed solely for the purpose of generating analysis results, and are deleted on the schedule described under Data Security.
  • You may request deletion of your account and all associated data at any time from your account settings.

Responsible Disclosure

  • If you discover a security vulnerability, please email security@scrublyiq.com.
  • We commit to acknowledging reports within 48 hours and resolving critical issues within 7 days.

Read our full Privacy Policy.