Security & Data Handling

How the conversion works

1. 1. Upload over an encrypted connection. Your PDF travels from your browser to our servers over HTTPS. It is never sent anywhere else from your browser.
2. 2. Automated extraction. The PDF is held in temporary storage only as long as the conversion takes. The text is read from it and processed automatically into structured transactions.
3. 3. Immediate PDF deletion. Once extraction finishes, the temporary PDF file is permanently deleted from disk. The original document does not persist beyond the processing window.
4. 4. Structured data storage. The extracted transactions — security descriptions, dates, proceeds, basis, adjustments — are stored in our database for up to 90 days so you can review and download them as CSV, TXF, or Excel.
5. 5. Download via your account. Access to your converted files is tied to the account you signed in with (Google or email link). Conversion-ready emails include a private tokenized link to the same results.

What we do not do

• We never ask for your broker login. Unlike TurboTax's auto-import or similar tools, 1099-B Converter only needs the PDF. Your brokerage credentials never leave your control.
• No human review of your documents. Extraction is fully automated end to end. No employee, contractor, or operator opens your PDF or reads your transactions.
• We do not train AI models on your data. Our processing provider operates under commercial terms that exclude this traffic from model training, and deletes it from their systems within 30 days. Your transactions are not used to improve any model.
• We do not sell, share, or rent your financial data. Your extracted transactions are visible only to you (via your account) and any party you explicitly forward the download to.
• We never store a password. Sign-in is passwordless: Google OAuth or a single-use email link that expires in 30 minutes and is invalidated after your next sign-in. There is no password database to breach.

Third parties involved

• Document processing provider — performs the automated extraction. The text content of your 1099-B is transmitted to them for processing. Their commercial terms exclude this traffic from AI model training, and they delete it from their systems within 30 days. If you need the provider named for a compliance or vendor review, write to [email protected] and we'll tell you.
• Stripe — payment processing for paid conversions. Card details are sent directly to Stripe and never touch our servers. Stripe privacy policy.
• Google Sign-In — optional sign-in method. Google shares your email, name, and profile picture with us; we never see your Google password.
• Resend — delivers transactional email (sign-in links, conversion notifications). Resend processes the recipient address and message content; your PDF and transaction data are never attached to emails.
• Google Analytics — anonymous usage and conversion measurement (page views, sign-ups, purchases). It never sees your PDF content or extracted transactions.
• Microsoft Clarity — session replays and heatmaps for usability. Your extracted transactions, totals, and file names are masked in recordings; Clarity never sees your PDF content.
• Hetzner — cloud server hosting, United States.
• Cloudflare Turnstile — bot protection that may be invoked on repeat uploads to prevent abuse. It does not see your PDF content.

Encryption and location

• HTTPS everywhere. All traffic to 1099bconverter.com is encrypted in transit. Plain HTTP requests are redirected to HTTPS.
• Located in the United States. Our servers and our database are located in the United States.
• The database is not reachable from the internet. It accepts connections only from the application itself, on a private network.
• Server-side processing only. No browser-side JavaScript ever sees your raw PDF content; the upload goes straight to the backend.

What's stored, and for how long

• Original PDF: deleted immediately after extraction completes. Not retained.
• Extracted transactions (JSON) and the original file name: stored in your account for up to 90 days so you can review and download them in CSV, TXF, or Excel format — then deleted automatically by a daily cleanup job. Access is tied to your account.
• Account information: your email address (plus name and profile picture if you signed in with Google), used to sign you in and notify you about your conversions. Not sold or shared.
• IP address and user agent: stored for rate-limiting and abuse detection. Not used for marketing or profiling.
• Stripe payment metadata: we store the Stripe payment ID for paid conversions to verify entitlement. Card data is on Stripe, not on our servers.
• Failure diagnostics: when an extraction fails, we keep derived signals only (page count, text length, yes/no pattern matches) to debug the failure — never the raw text of your document or the AI's raw response.

You can delete any conversion yourself at any time from the My Conversions page. Prefer email? Write to [email protected] and we'll process the deletion for you.

What 1099-B Converter is not

We're an extraction tool, not a tax advisor. A few honest distinctions:

• We extract what's on the PDF. We do not apply RSU or ESPP cost basis adjustments automatically — those require your broker's supplemental statement and your W-2 income data, which we don't have access to.
• We do not file your return. The output is a CSV, TXF, or Excel file you upload into TurboTax, TaxAct, H&R Block, or hand to your accountant.
• We do not validate IRS rules. If your 1099-B has unusual codes or your filing scenario is complex (Section 1256, dual-status NRA, large wash sale activity across accounts), the extraction is accurate but the tax treatment is your decision or your preparer's.

Reporting a security issue

If you discover a vulnerability — anything from authorization issues to data exposure — please email [email protected] with details. We respond to security reports within 48 hours and prioritize fixes ahead of feature work.