Where does my bank statement actually go?
You're about to hand a piece of software your bank statements. The honest answer to "where does this go" isn't one sentence, because it depends on a choice you make in Settings. This page is that answer, in full, including the one part of it we're not happy with yet.
Short version, if you read nothing else: the model that sees your finances is the one you picked, and it's either running on this computer or an address you supplied yourself. There's a second, optional, more capable model that's kept away from your data by design, and one specific job it can do today — building support for a bank we don't recognise — where that design isn't holding yet.
Three lists, not a toggle
Open Settings and you'll find separate lists of models, not one list with a privacy switch on it.
Trusted Models is where your everyday model lives, the one you actually talk to. It sees your statements, your questions, everything in a project. You can only put two kinds of thing on this list: a model Orby downloads and runs itself, on this machine, or a model you point at with your own web address, something on your home network or a provider you already have an account with. Orby will not let you add Anthropic's API, Google's API, OpenRouter, or an external agent like Claude or Codex directly to this list. Those can only go on the other one.
Untrusted Supporting Models is optional, and empty by default. It's for one specific job: when your trusted model hits something it can't do alone and needs help from something more capable. Nothing on this list is supposed to see your statements, your account numbers, or your documents. It exists to answer questions your trusted model composes in general terms, not to read your data directly.
Embedding Models is a third, separate list, easy to miss because it isn't framed as a privacy setting, but it is one. This is the model that turns your messages into something Orby can search back through later, for memory. It runs on every message you type, including questions about your finances, whether or not the question itself names a number. If you set a remote embedding model, every question you type goes to it. This is also why the app's own privacy indicator won't call a session "fully local" just because your chat model is local — it checks the embedding model too.
This is a setting, not a claim
We're not asking you to believe that Orby "keeps your data private." That's not checkable. What is checkable: everything that could see any part of your data is one of a small, fixed number of things, and every one of them is listed in Settings, not hidden in code you'd have to read to find. If Trusted Models and Embedding Models are both set to something local, and Untrusted Supporting Models is empty, nothing about your money has anywhere else to go.
That's not the same as a guarantee that nothing ever leaves. It depends on what you've actually set, and there's one real exception below that holds regardless of what you've configured. Read that before you decide this page has answered everything.
The sidebar tells you, every time
Every conversation carries a live indicator showing what actually happened: whether the answer came entirely from a model running on this machine, or whether something crossed to a model you configured elsewhere. It updates per answer, not once at the start of the conversation.
You shouldn't have to remember what you set up three weeks ago. The indicator is there so you don't have to.
Where this doesn't hold yet
Most banks Orby recognises out of the box are American. If yours isn't one of them, and you use the built-in tool to teach Orby your bank's format automatically, here is exactly what happens: your entire statement, unredacted, is sent to whichever model you've set as your Untrusted Supporting Model. Not a summary. Not the redacted version. The whole document, as it reads, including the account holder's name, account number, and every transaction.
This isn't what we designed the untrusted list to do, and it isn't what turning on redaction in Settings fixes. We checked: with redaction switched on, this specific path doesn't call it at all. Not misconfigured, not bypassed, just never invoked. We're recording that here rather than waiting for you to find out.
The automatic builder uses whichever model is set as your Untrusted Supporting Model. What we have not confirmed is what happens if none is set at all. Until we've verified that ourselves, don't treat leaving it unset as protection. If your statement's privacy matters to you, use Option 1 or Option 3 on Adding your bank instead of relying on that.
What we'd suggest right now: if adding your bank matters to you and you'd rather not risk this, read Adding your bank before you try the automatic route. There's a slower way that doesn't have this problem, and for the alpha, you can also just tell us your bank's format and we'll add it the way we already add them.
The short version, as a table
| Situation | What sees your data | Leaves this machine? | Status |
|---|---|---|---|
| Ordinary question, local model set as trusted | The local model only | No | Measured |
| Ordinary question, your own network or provider set as trusted | The endpoint you configured | Yes, to where you chose, because you chose it | Measured |
| Trusted model escalates a stuck task to your support model | Your support model, on a question meant to be composed to avoid your data | Yes, by design, not with your raw statement | Intended, not yet verified — this is what the design is supposed to do, not something we've measured happening |
| Adding a bank automatically, support model configured | Your support model, with the entire unredacted statement | Yes, today, in full — see the exception above | Measured |
| Adding a bank automatically, no support model configured | Not confirmed | Not confirmed | Untested — don't rely on this as protection. |
Two rows above are marked unverified on purpose, not as a formality. The escalation row sits directly above the one path we did measure failing at exactly the same promise, "composed to avoid your data." That's the reason to treat its own unverified row with real skepticism rather than assuming it behaves better.
Where to go next
- Adding your bank — what to do when your format isn't recognised, and how to avoid the exception above entirely
- What isn't working yet — the rest of the honest list
- Install it — if you've read enough and you're ready