Is it safe to upload your bank statement?

It depends almost entirely on who is asking, and the answer most of the internet gives you — "make sure the connection is secure" — is about the wrong thing. A regulated lender is entitled to the statement and you should send it whole: redacting one for a mortgage application is the kind of thing that gets read as tampering. A letting agent, a broker, a "pre-approval" site or an employer is a different question, and the file itself gives away more than the transactions you are thinking about. If you do redact, SEAL rebuilds the page from pixels so the removed text is genuinely gone, and X-RAY shows what the PDF carries beyond what is printed on it. Neither uploads the file.

First: notice who is telling you it is fine

Search this question and the first page is largely written by services that work by having you upload a PDF, and by mortgage companies who would like the document. That is not a conspiracy — it is what happens when nobody without a stake writes the page. It does mean the advice you get back is about the transport ("use a secure portal", "don't email it") and almost never about the document.

Transport is the easy part and mostly solved. What survives afterwards is a complete copy of the statement sitting on somebody's system, under their retention policy, reachable by their staff and their breaches. That is the risk worth thinking about, and it is decided by who you hand it to, not by the padlock in the address bar.

Who is asking, and what that changes

The one that catches people is the middle row. A letting agent asking for three months of bank statements is asking for a list of everywhere you shop, every subscription, every transfer to a family member, and — from the merchant names alone — a reasonable guess at your health, your politics, whether you gamble and whether you are seeing a solicitor. Very little of that is needed to establish that you can pay the rent. Asking what they need, and offering a reference or payslips, is a normal and reasonable thing to do.

Never redact a statement for a lender

Worth saying flatly, because the instinct after reading the paragraph above is to black out the transactions you would rather not discuss. An affordability assessment is a legal process and the lender is required to see the real picture. A statement with parts removed is at best returned and at worst treated as an attempt to mislead, which is a materially worse situation than an awkward conversation about a transaction.

If something on the statement needs explaining, explain it in a covering note. Underwriters read those every day.

What the file carries that is not printed on it

Where redaction is appropriate — and it often is for the agent, the broker and the employer — the visible transactions are only part of what leaves with the file.

• Document metadata. The producing software, the creation and modification times, and often an internal document or customer reference from the bank's own system. X-RAY lists it.
• A text layer under the ink. This is the big one. Draw a black rectangle in Preview, Acrobat's markup tools, or almost any annotation app, and you have drawn a picture of a black rectangle on top of text that is still there, selectable, copyable, and readable by any search index the file ends up in. It is how redaction failures reach the news, and it has happened to law firms and government departments repeatedly.
• Structured data. Some banks embed a machine-readable version of the transactions alongside the printed page. Blacking out the printed line does not touch it.
• The account number and sort code, which are usually printed in a header that people redact on page one and forget on pages two through nine.

Redacting one properly

1. Work on a copy, and keep the original. You may need to produce it later.
2. Decide what the recipient genuinely needs — usually the name, the period, the balance and the income lines — rather than starting from what you want to hide.
3. Redact with something that removes rather than covers. SEAL rebuilds each page from painted pixels, so the exported PDF has no text layer at all and there is nothing underneath the boxes. It also gives you the SHA-256 of what you exported, which is worth keeping with your copy so you can show later exactly which version you sent.
4. Check every page, including the header on each one and the summary page at the back.
5. Read it back and try to select the text you removed. If you can, it is not redacted.
6. Strip the metadata afterwards with SCRUB, or use CLEANROOM to do the metadata pass in one go.

And do not upload it to find out

The irony of this particular question is that the usual way to redact a PDF is to put it through a website, which means the unredacted statement — the exact document you were worried about — is now on a stranger's server before any of it is blacked out. Whatever their policy says, you have made the disclosure you were trying to avoid, and you have made it to a party with no reason to hold it.

Everything above runs in the browser tab you have open. You can confirm it in the browser's own network panel, or by loading the page and then turning the network off, which is a better assurance than a sentence on a pricing page.