From a PDF to a figure you can defend.
Ten steps, every one of them on your device. Each one can stop the run, and none of them can approximate a figure.
The application
In a browser it is the engine compiled to WebAssembly, served over HTTPS and then held in the tab, sandboxed by the browser like any other page. On a laptop or a server it is a single install. Either way the download is the last network request it makes.
On-device import
A statement is read where it already sits. The text layer is extracted on the device, so there is no upload step to opt out of and no queue on somebody else's hardware.
OCR for scans
Photographed and scanned statements are recognised on the same machine. A character is accepted once the figures it produces tie. Where two readings both tie, the run stops and asks.
Template-free parsing
Columns, dates and amounts are inferred from the geometry of the page, so a layout nobody has configured still parses. A per-bank template only makes it faster.
Cast and cross-cast
The oldest check in bookkeeping, applied to every statement: the column must cast, so opening plus the movements equals closing, and each row must cross-cast against its own running balance. A statement that fails either check goes no further, and nothing downstream runs on figures that did not pass.
Derived amounts
Some layouts print Money out / Money in and no signed figure, so the amount is derived from the balance movement. That makes the row check circular, leaving the printed magnitude as the only independent witness. A disagreement stops the run.
Transfer matching
Movements are matched across institutions by amount, direction and date window, so one transfer becomes one movement instead of two unexplained entries. Anything unmatched is held and named.
Currency conversion
A conversion is recorded once both legs appear on statements and the implied rate reconciles to the penny. An unevidenced rate is blocked.
Exports that post
Figures leave in the layouts other software expects: bank-import CSV for Xero, Sage, QuickBooks and FreeAgent, journals and trial balance for accounts production, VAT and ITSA figures for bridging software, XLSX for Excel, and a PDF pack for the file. Each row carries the receipt that proves it.
Deterministic output
No sampling, no temperature, no model call at run time. The same statements produce identical files today and in ten years, so an audit trail can be replayed rather than taken on trust.
Where the data lives.
Enclave keeps no copy of anything, so every question about storage, backup and retention is a question about your own infrastructure. What that means in practice depends on how you run it.
| Browser tab | Installed on a laptop or server | Sovereign | |
|---|---|---|---|
| Where the data sits | In the tab, for as long as it is open. Statements are opened from your disk and never copied anywhere else. | A workspace folder on the machine or volume you point it at. | Storage you nominate, inside your own estate. |
| What is left afterwards | Nothing. Close the tab and the only files that remain are the ones you chose to save. | Statements, the parse cache and your exports, all as ordinary files you can read without us. | The same, held under your retention and deletion policy. |
| Encryption at rest | None is added, because nothing is written. | Your disk or volume encryption does the work: BitLocker, FileVault, LUKS. The stored statement passwords are separately encrypted with a key you set. | Your keys, in your KMS or HSM. We hold no key material and cannot decrypt anything. |
| Backups | Your existing file backup already covers the statements and the exports. | The workspace is ordinary files, so the snapshot and restore tooling you already run works unchanged. | Your regime, your schedule, your retention. There is no vendor copy to subpoena, lose or restore from. |
| Updates | Fetched when the page is loaded, then nothing. | Installed when you choose to install them. | Signed rule packs delivered as files and installed on your schedule. The pack version is recorded against every figure, so a filing can be reproduced years later. |
| Network | HTTPS to load the page. No request after that. | None required once installed. | Runs fully air-gapped. |
| Licence | Per seat. | Per seat, with admin, member and read-only roles. | Site licence, unlimited seats, source escrow on request. |
The browser build saves nothing
Browser storage is not meaningfully protected from anyone who can reach the profile, so the browser build does not use it. Statements are read into the tab and the results are saved where you tell them to go. If you want a workspace that persists, run the installed build on storage you already control and already back up.
Encryption at rest, stated honestly
Disk encryption protects a stolen laptop, a lifted volume snapshot, a workspace copied into a ticket. It is worth nothing against someone who already has a session on the machine, and we will not imply otherwise. The protection that does the heavy lifting here is that the data never leaves your estate.
No processor to appoint
Because no statement reaches us, there is no third-party processor in the chain: no data processing agreement to negotiate, no international transfer assessment, and no breach notification that depends on our controls. Your DPA obligations stay where your data already is.
The constitution is the product.
Six rules. We follow them even when they make the product harder to build.
Never upload.
There is nowhere to upload it to. Enclave runs where your data already is, on a laptop, a server or in a browser, so the data never moves.
Never guess.
Where the arithmetic cannot prove a figure, processing stops and names what failed. No estimate is ever exported.
Never hold credentials.
No OAuth, no stored passwords, no consent screens. We cannot lose what we never store.
Always tie.
opening + Σ = closing on every statement, and row by row on every balance. Nothing ships until it does.
Report every failure.
Any failure is shown immediately, on the figure it affects, and it stops the export rather than sitting in a log.
Same input, same output.
The same statements always produce identical results, this year and in ten years. Every audit trail can be replayed in full.
AI at build time only.
AI drafts parsers and rule packs offline, at build time. A person reviews them, and they are frozen into data the engine executes.
At runtime the engine is pure arithmetic, with no inference and no confidence scores. Every figure can be replayed from the same inputs.
- 2023 Q4the reconciliation check · opening + Σ = closing becomes a hard stop
- 2024 Q2template-free parsing · statements nobody configured
- 2024 Q4the browser build · the engine in a tab, connect-src 'self'
- 2025 Q2transfer graph · legs matched to counter-legs across institutions
- 2025 Q4brokers & exchanges · statements from any venue reconcile
- 2026 Q2treasury surface · every currency, one proved number
Enclave Desk.
The interface a practice works in: clients, imported statements, matched transfers and the reports that come off them.