Statemint

Bank statements arrive as password-protected PDFs. Somebody opens one, opens a spreadsheet next to it, and types. Every month. The tools offering to fix this ask you to upload the statement to their server, or hand over your banking login so they can fetch it themselves. For anyone who understands what is being asked for, that is where the conversation ends. Statemint reads Gmail read-only and parses on the machine it runs on. Nothing is uploaded. The hard part was not parsing but drift: every bank formats differently and changes without telling anyone, so it fails loudly and skips a row it cannot read rather than confidently producing a wrong number. A missing line is visible. A wrong balance is not.

The Gmail token is the only sensitive thing this holds, so it is encrypted with KMS and the scope is read-only. Nothing else about your finances exists on any server I control, which is the point of the whole design rather than a feature of it.