Is It Safe to Upload Bank Statements to Claude?
It’s safe enough for your own statements if you strip the account numbers, keep the chat out of training and memory, and check every total against the statement yourself. Someone else’s statements are a different question, and on a personal plan I’d say no.
We ran 15 months of bank statement PDFs through Claude Code before we moved to QuickBooks, and the accuracy section comes from that. Claude Code skips the chat upload button, so I didn’t test the chat settings below. They come from public pages I read on October 30, 2026.
Does incognito keep my bank statement private?
Less than the name suggests. An incognito chat skips your history and memory, and it’s “not used for training.” But Anthropic says incognito chats “are retained for either 30 days (default), or longer” under an Enterprise retention setting.
On a company seat, the same page says “Incognito chats are included in organizational data exports available to account Owners.” So if you upload a personal statement in incognito on your work seat, your employer can export that chat. On Enterprise, the Compliance API also covers incognito chats, and it reaches “uploaded files.” Who can see what on a company seat has the details.
Incognito also takes tools away. In the new Claude experience, incognito chats “open in the previous chat experience, so Claude can’t create files or run code in them.” So you do the balance check yourself, in a spreadsheet.
On a personal plan I’d still use it for a one-off question, since it covers training, memory and history in one click.
What changes by plan?
Training and memory defaults change, and the 30-day clocks mostly don’t. From Anthropic’s incognito page, its personal and commercial retention articles, its personal and commercial training articles, and its memory guide:
| Free, Pro, Max, Ultra | Team | Enterprise | |
|---|---|---|---|
| Training | A setting you choose | Off by default | Off by default |
| Deleted chat | Gone from back-end within 30 days | Same | Same |
| Incognito chat | Kept 30 days | Kept 30 days, in organization exports | 30 days or your retention setting, in exports and the Compliance API |
| Memory | On by default | Off until the member turns it on, if owners allow it | Same as Team |
Does Claude train on uploaded bank statements?
On a commercial plan, no, unless you send feedback: “By default, we will not use your inputs or outputs.” On a personal plan, only if the training setting is on, and the setting lives under Settings, then Privacy, as “Help Improve our AI models.” Turn it off before you upload. Turning it off later doesn’t pull your data out of training that has already started.
With the setting on, an uploaded statement can be training data. Anthropic’s Privacy Policy counts “uploading files” as providing Inputs, and says “We may use your Inputs and Outputs to train and improve Anthropic AI models, unless you opt out through your account settings.” The training article carves out one thing: “It does not include raw content from connectors.” Uploads aren’t in that carve-out. By that wording, your numbers are better protected coming through a connector than in a PDF you drop in the chat.
Two exceptions apply whatever your setting says. Conversations flagged for safety review can be used to improve Anthropic’s enforcement. And a thumbs up or down stores “the entire related conversation” for up to 5 years, on every plan, so don’t rate these chats.
How long does Claude keep an uploaded document?
Anthropic publishes the clock for chats: kept until you delete the chat, then off the back-end within 30 days. Flagged chats stay longer: inputs and outputs for up to 2 years. With training on, de-identified data can stay “for up to 5 years.” The law can extend that too.
For the current version of memory, Anthropic’s guide says “When a conversation is deleted, including under a retention period, memory entries generated from it aren’t removed.”
Anthropic lists “financial account numbers” among the things “never saved to memory,” but not balances or income. Before your first message, open the “+” menu and turn off Memory for that chat, or use incognito. Afterward, read what Claude remembers under Settings, then Your Claude, then Manage.
Keep statements out of project files too. Those are “for persistent reference across conversations,” and incognito isn’t available in projects.
What should I redact before uploading a bank statement?
Everything Claude doesn’t need to do the math:
- Full account and routing numbers, and card numbers
- Your name, address and the bank’s reference numbers
- Social Security numbers and EINs
- Names of people you paid, if the question doesn’t depend on them
Keep dates, descriptions, amounts and the opening and closing balances, because those are what you’ll check against. If your bank offers a CSV export, start there and delete the columns you don’t need.
A black rectangle doesn’t count as redaction. A federal court’s redaction guide warns about highlighting over text in a PDF: “Anyone can copy the black box, paste it into a word-processing document, and the information under the black box will appear.” It matters here because Anthropic’s API docs say “The text from each page is extracted and provided alongside each page’s image,” and its upload guide says the app “analyzes both text and visual elements” in PDFs of 100 pages or fewer. Text you covered is still text. Save the redacted file as a new copy, search it for your account number, and try to select the area under the box. If anything comes up, redo it with a tool that removes the text.
Can Claude read numbers off a bank statement accurately?
Mostly, and “mostly” is the problem. Anthropic’s terms say outputs “may contain material inaccuracies even if they appear accurate” and “You should not rely on any Outputs or Actions without independently confirming their accuracy.”
A developer who built a statement converter on the API writes that “Claude occasionally misreads 1,234.56 as 123456 or 12.34.” A misplaced decimal looks like a perfectly normal number.
Our bookkeeper on Claude Code had a script that ran after every write to the transactions file. It added up each month and compared the result with the statement’s own totals and its starting and ending balances. Anything off by more than a cent got flagged. Over 559 transactions, all 15 monthly statements reconciled to the cent. That shows the finished books tied out, not how often the first read was wrong. The AI read the PDFs, and a dumb script decided whether to believe it.
In a chat, run the same check by hand:
- Ask for a table with one row per transaction, then copy it into a spreadsheet.
- Have the spreadsheet add it up. Don’t use a total Claude typed.
- Check that opening balance plus the sum equals closing balance, month by month.
Anthropic’s upload guide says that for PDFs “from 101 to 1000 pages, Claude processes text only and doesn’t analyze visual elements.” A scan with no text layer is only pictures, so in a file that long Claude has nothing to read. Upload a month at a time.
Can I upload tax documents or confidential documents to Claude?
Your own tax documents follow the same rules, and the Social Security numbers come out first.
Someone else’s documents are where I’d stop. Training settings don’t release you from an NDA or a client agreement, because those limit where a document can go at all. Anthropic’s Privacy Policy puts this on you too: when you upload files, “you are responsible for ensuring you have the necessary rights, permissions, or authority to do so.” If you prepare tax returns, 26 CFR 301.7216-1 describes “a criminal penalty for tax return preparers who knowingly or recklessly disclose or use tax return information for a purpose other than preparing a tax return.” The next section lists exceptions, including one for contractors on tax software. Whether Claude fits is a question for your counsel, before the first upload. This isn’t legal advice. Can I put client data into Claude? covers the rest.
Anthropic’s Usage Policy also lists “preparing a tax return for them to sign or file” as high-risk: “A qualified person must meaningfully review” it, and the client must be told AI was used.
Don’t mix in documents from strangers either. On its page about code execution and file creation, Anthropic warns that a bad actor can “inconspicuously add instructions via external files,” and that Claude “can be tricked into sending information from its context.” A vendor’s PDF in the same chat as your statement puts both in that context.
Is uploading safer than connecting my books?
For one question, yes. An upload gives Claude one file you chose, and it can’t change anything in your books. A connector stays connected, and QuickBooks’ can create, send and delete invoices. The table of what 33 connectors can change compares the rest.
Connecting a folder is the worst of the three for this. Anthropic says Claude “can read, write, and permanently delete” files in a folder you give Cowork, and tells you to avoid doing that with “financial documents.”
If a statement keeps coming back every month, a one-off upload has become a process. Our answer to that was a bank feed and QuickBooks.
What I couldn’t confirm
- Whether an uploaded file leaves the back-end on the same 30-day clock as its chat. The retention pages say “conversation” and never mention uploaded files.
- Whether memory saves balances or income.
- Whether incognito accepts every file type. Its page doesn’t mention uploads, and XLSX uploads need code execution, which incognito lacks in the new experience.
- Whether a Team or Enterprise organization export holds the uploaded file itself. A member’s own export doesn’t, and Anthropic doesn’t say for the organization’s.
- How accurate Claude is on statements. The only figures I found are self-reported, from that same developer: 98.2% on digital PDFs and 94.1% on scans.
What should I do before I upload?
Make a redacted copy, or use the CSV. Open incognito on your own personal account, or turn off training and Memory first. Check the totals in a spreadsheet, then delete the chat. For a team, write the rule down: the one-page connector policy already keeps regulated data out until someone who owns the risk signs off.
If you’d rather plan which of your tools to connect, and how, the setup planner asks six questions and gives you a plan without asking for an email. If you want a second look at what your team already does, bring it to a 30-minute call.
