Trust & Security

Your merchants’ data is handled like it matters. Because it does.

ScrublyIQ reads real bank statements for real merchants. Here is exactly how we protect that data, and how we grade the deals you run through it. Plain language, no asterisks.

Your data is protected

Identifiers stripped before AI processing

Social Security numbers, EINs, routing numbers, and account numbers are removed from statement text at every processing stage: and an automated release gate blocks any build where a planted identifier survives.

Encrypted at rest and in transit

Merchant identity and enrichment data are encrypted in the database with AES-256-GCM. All data moves over TLS, with HSTS enforced.

PDFs deleted on a 72-hour schedule

Your uploaded bank-statement PDFs are deleted by a scheduled retention job once they are 72 hours old; deletion is normally completed within 24 hours after that point. Raw statement text is never kept after processing. The one exception is a small, fixed set of statements we hand-select for accuracy testing of our extraction software, which is retained longer for that sole purpose. That testing does not train, fine-tune, or otherwise modify any AI or machine-learning model (see our Privacy Policy).

Account numbers minimized

Full account numbers are never stored: only the last four digits, as a masked identifier. Routing numbers are never stored.

Checked on every scan

Every analysis runs PDF-metadata forensics and balance reconciliation to catch tampering. Sanctions screening against the OFAC SDN list runs only when business verification is switched on, and it is off today.

How ScrublyIQ tiers deals

ScrublyIQ reads a merchant’s statements and sorts the deal into a simple tier: A, B, C, or D, so you know at a glance where it stands before you shop it. Here is what each tier means in plain terms:

  • A

    Cleanest. Strong, consistent deposits, healthy balances, little to no negative activity. Best terms and the widest funder appetite.

  • B

    Solid, minor blemishes. Good fundamentals with a few small dings: an occasional low day or a slightly thin month. Fundable with most funders on solid terms.

  • C

    Real friction. Genuine issues: inconsistent revenue, negative days, or stacking pressure. Still fundable, but with fewer funders and tighter terms.

  • D

    High-risk. Serious red flags: heavy negatives, NSF clusters, or signs the file needs a closer look. Exception funders only, if at all.

This is how ScrublyIQ tiers a deal: not an industry standard or a funding decision. Every funder sets its own box, so treat the grade as a strong starting read on where a deal fits, not a guarantee of approval.

Security details

How ScrublyIQ protects your data, your merchants, and your business.

Data Security

  • Uploaded PDFs are deleted by a scheduled retention job once they are 72 hours old; deletion is normally completed within 24 hours after that point.
  • Exception: a small, fixed set of statements that we hand-select is retained beyond this window, indefinitely, for the sole purpose of internal regression and accuracy testing of our own extraction software. That testing measures whether the software still reads documents correctly; it does not train, fine-tune, or otherwise modify any AI or machine-learning model, and we do not use this data, de-identified or otherwise, to do so. These statements are kept in private, service-role storage that is never exposed to the application or to other brokers, are never shared, sold, or used for any other purpose, and are not something a broker can opt into or out of. Every statement outside this hand-curated set is deleted on the standard 72-hour schedule.
  • Within that same window, the merchant’s identity, the masked bank-account identifier, all third-party enrichment and verification results, and broker notes are permanently purged. A de-identified analysis record: date, status, risk tier, and an aggregated financial summary (monthly totals, ratios such as DSCR, the fundability score, and the underwriting narrative): is retained for the broker’s portfolio history. The raw statement documents and transaction-level detail do not survive this window.
  • Account numbers are never stored in full: only the last four digits are retained. Routing numbers are never stored.
  • Raw statement text is never persisted after extraction; it exists only transiently in memory during processing.
  • All uploaded statements are stored in private, encrypted Supabase storage: never on local disk and never publicly accessible. They are served only through short-lived signed URLs scoped to the authenticated broker.
  • Merchant names, business locations, and all enrichment data are encrypted at rest using AES-256-GCM before database storage.
  • All data is encrypted in transit using TLS (1.2 minimum; TLS 1.3 with modern clients).
  • HSTS (HTTP Strict Transport Security) is enforced with a 2-year max-age and preloading.
  • When the primary parser cannot read a PDF, our backup extraction service receives a link to it that expires after 90 seconds. Statement content is sent only to the processing services named in our Privacy Policy (Anthropic, Google Cloud Document AI and that backup service) and never to verification partners.

Access Control

  • Authentication is provided by Clerk, a SOC 2 Type II certified identity provider. ScrublyIQ never stores broker passwords: credentials are managed entirely by Clerk.
  • Every endpoint that returns or accepts broker or merchant data requires an authenticated session. Eight machine endpoints (scheduled jobs, the Clerk and Stripe webhooks, and the background job runner) are authenticated by shared secret or cryptographic signature instead. The one endpoint that requires no authentication is a liveness check that returns no broker or merchant data.
  • Multi-factor authentication is available and recommended for all accounts.
  • Role-based access: organization administrators control member access and can suspend users with immediate session invalidation.
  • All data access is scoped to the authenticated user’s account or their organization.

Fraud & Compliance Screening

  • When business verification is switched on, each analysis screens the merchant against the OFAC SDN list. It is off today, so brokers remain responsible for sanctions and watchlist checks before submission.
  • PDF metadata forensics run on every uploaded statement to detect post-creation modifications.
  • Statement balance reconciliation verifies mathematical consistency to detect edited transactions.
  • Duplicate statement detection prevents the same file from being analyzed twice.
  • Business verification data (name, address, registration number) submitted by brokers is shared with trusted verification partners including OpenCorporates, Melissa Data, UniCourt, Middesk, IRS TIN Matching, Smarty, and Google Places. Bank statement content, transaction history, account numbers, and financial records are never shared with these verification partners.

Infrastructure

  • Hosted on Vercel’s global edge network with automatic failover.
  • Database hosted on Supabase PostgreSQL with encrypted automated backups for disaster recovery, purged on a rolling cycle.
  • Row-Level Security (RLS) is enabled on all database tables.
  • Per-user and per-organization rate limiting via Upstash Redis distributed rate limiters covers 71 of our 80 API endpoints, which is every broker-facing route. The nine without it are the eight machine endpoints described under Access Control and the liveness check. A separate per-IP limit at the edge fronts every route except the liveness check and the signed payment and identity webhooks.
  • Audit logging records admin actions, deal views, exports, funder sends and account changes. Sign-in events are recorded by our identity provider, Clerk.

Privacy

  • We do not sell, rent, or share your data with third parties for marketing purposes.
  • Bank statement PDFs are processed solely for the purpose of generating analysis results, and are deleted on the schedule described under Data Security.
  • You may request deletion of your account and all associated data at any time from your account settings.

Responsible Disclosure

  • If you discover a security vulnerability, please email security@scrublyiq.com.
  • We commit to acknowledging reports within 48 hours and resolving critical issues within 7 days.

Read our full Privacy Policy.