Service-provider record: ZeroParse Statements
For your firm's Written Information Security Plan (WISP). The FTC Safeguards Rule asks you to choose service providers that can protect customer information, require it of them by contract, and reassess them from time to time. This page sets out what you need to record about us, in that order.
This is our self-attestation, to help you complete your own record. It isn't legal advice, and filing it doesn't make your firm compliant: the assessment at the end is yours to make.
Facts as of our last review, 4 October 2026.
1. The service provider
- Service
- ZeroParse Statements: converts bank and card statements into CSV, Excel, QuickBooks and Xero files.
- Operated by
- Wedgr Technologies, Singapore (UEN 53532707B), 104 Punggol Walk, Singapore 828792
- Security contact
- support@getzeroparse.com
- Website
- https://getzeroparse.com
2. Customer information it handles
Relates to choosing a provider able to safeguard the information (16 CFR 314.4(f)(1)).
- CSV, Excel, OFX and QFX files
- Read entirely in your browser. They are never sent to our servers.
- PDFs
- Sent over TLS to our extraction service, held in memory only while they are read, and dropped as soon as the transactions are returned, whether extraction succeeds or fails. They are never written to disk. Our backend tests, run on every change, check that both typed and scanned PDFs leave nothing on disk.
- Statements clients send through upload links (Firm)
- Encrypted in the client's browser with a key only the firm holds, behind a passphrase we never receive. We store them in that form until the firm collects them, or 72 hours at most, then delete them. We hold no key that can open them.
- The year-end pack, the cash-flow summary and the case view
- Worked out in your browser from the rows already on your screen. Nothing is sent to us to build them, and nothing about them is kept, including what you tick as reviewed in the case view: it's gone when you close the page, like the rows.
- What we do keep
- Your account (email, plan, credit balance and credit history), and for each run a non-content record: file type, page count and timing. Never transaction data.
- Statements in error reports or logs
- No. Error reports are scrubbed before they leave: no request bodies, cookies, headers or query strings, and accounts appear only as an internal ID or one-way hash.
3. How it is protected
- Encryption in transit
- TLS 1.2 or higher everywhere, with HSTS (two years, subdomains, preloaded).
- Encryption at rest
- Account and billing data is held in Supabase's managed Postgres, encrypted at rest by the provider.
- Tenant isolation
- Postgres row-level security on every table in the database: one account's data can't be read by another signed-in user. The service credential that bypasses it is used only on our servers, never in the browser.
- Sign-in
- Email and password, or Google. Passwords must meet a length and complexity rule, sign-in attempts are rate-limited, and a Cloudflare Turnstile bot check guards sign-in, sign-up and password reset. Passwords are stored and checked by Supabase Auth; we never store one ourselves.
- Our own access
- The operations console is limited to a named allow-list of staff, each with a verified account. Every action taken on a customer's account there (support access, credit changes, refunds) is written to an append-only audit log.
- Browser protections
- A Content Security Policy with per-request nonces, framing denied, MIME sniffing off, a strict referrer policy, and camera, microphone and location access turned off.
- Payments
- Handled by Stripe. Card details go to Stripe directly and never reach our servers.
4. Who else processes it
The services that handle data for us, and whether each ever sees a statement's contents.
| Provider | What it does | Sees statement contents | Where |
|---|---|---|---|
| Render | Runs PDF extraction | In memory, briefly | United States (Virginia) |
| Vercel | Hosts the website and its server functions | Never | United States (Washington, D.C.) |
| Supabase | Sign-in and the account database | Never | United States (N. Virginia) |
| Stripe | Takes payment for your subscription | Never | Set by Stripe |
| Resend | Sends account and support email | Only if you attach one | Set by Resend |
| Sentry | Error reports, with contents scrubbed | Never | United States |
| Cloudflare | Bot check (Turnstile) on sign-in and sign-up forms | Never | Set by Cloudflare |
5. What the contract requires
Relates to requiring safeguards by contract (16 CFR 314.4(f)(2)).
- Data processing agreement
- Our DPA is part of our Terms for any account used to process clients' data, so it applies without a separate signature. Privacy is governed by our Privacy Policy under Singapore's PDPA.
- Breach notification
- If we confirm a breach affecting your account credentials or billing data, we notify you without undue delay, under the PDPA. Statement contents can't be taken from us at rest, because we don't keep them.
- Deletion
- Delete your account yourself from the same page. Statement contents need no deletion: we never had them.
- Export
- Download everything we hold about your account, as JSON, from Account → Your data.
6. What we don't have yet
Said plainly, so your record doesn't assume them. If your plan requires either, note how you cover the gap.
- SOC 2 or ISO 27001
- Not yet. We rely on our infrastructure providers' own certifications, and on request (once a year, or after a suspected incident) we'll complete your security questionnaire.
- Multi-factor authentication
- Not offered yet.
7. Your assessment
Relates to periodically assessing the provider (16 CFR 314.4(f)(3)). Filled in by your firm.
- Assessed by
- Date assessed
- Decision and conditions
- Next assessment due
To reassess, open this page again: it always shows our current facts and the date we last reviewed them. The full sheet is on our Security page.