Overview
Financial Data Extraction Platform turns scanned and digital bank statement PDFs into structured, reconcilable transaction data - without sending sensitive financial records to a third-party processor. The full stack (web app, AppSync GraphQL API, Cognito user pool, DynamoDB tables, Lambda pipeline, S3 buckets) deploys into your own AWS account via a single CloudFormation stack, so all data and access logs stay within your VPC, region, and IAM boundary.
Pipeline. Upload a multi-page PDF; Amazon Textract is invoked asynchronously with TABLES + FORMS + QUERIES. Handwriting and signature density are scored automatically and statements above the threshold are quarantined to a separate KMS-encrypted bucket for review. Successful extractions populate a transaction table with per-row bounding boxes for the side-by-side reviewer, plus header metadata (account number, holder, period, starting/ending balances). A reconciler validates the running balance against the extracted total and flags the document if the delta exceeds tolerance.
Review and export. Reviewers correct individual rows with full audit-trail capture; admins build XLSX/CSV export templates with column ordering, filters, and granularity choice (transaction- or document-level). Recurring exports run on cron and deliver to operators via SES email or a presigned-link download. CSV and XLSX writers neutralize formula-injection payloads (=, +, -, @ prefixes).
Compliance posture. Cognito enforces TOTP MFA and a Pre-Token-Generation v2 trigger writes an organizationId claim into both the access and ID tokens so AppSync's owner-field rules give every request strict per-tenant data isolation. S3 buckets use customer-managed KMS, Object Lock (7-year retention floor), bucket-key acceleration, and a deny-insecure-transport policy. GuardDuty Malware Protection scans every upload before it enters the extraction pipeline. CloudTrail data events on every storage bucket and a dedicated audit DynamoDB table record every state-changing action with the caller's sub, role, and IP.
Operations. Single-stack CloudFormation template - bring your own VPC or let the stack create one. ECS Fargate behind ALB with horizontal autoscaling. Optional HTTPS listener gated by a CertificateArn parameter. No proprietary runtime: every component is a standard AWS service.
Highlights
- Stays in your account. Single-stack deployment into your AWS region - your PDFs never leave your VPC, your KMS keys, or your IAM boundary.
- Audit-ready by default. Cognito MFA, per-tenant token claims, Object Lock retention, GuardDuty malware scanning, and a tamper-evident audit log on every action.
- From PDF to export in minutes. Async Textract pipeline auto-extracts transactions with bounding boxes, reconciles against statement balances, and emails recurring XLSX/CSV exports.
Details
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Financing for AWS Marketplace purchases
Pricing
- Monthly subscription
- $9,000.00/month
Vendor refund policy
temp
How can we make this page better?
Legal
Vendor terms and conditions
Content disclaimer
Delivery details
CloudFormation deployment to your AWS account
- Amazon ECS
Container image
Containers are lightweight, portable execution environments that wrap server application software in a filesystem that includes everything it needs to run. Container applications run on supported container runtimes and orchestration services, such as Amazon Elastic Container Service (Amazon ECS) or Amazon Elastic Kubernetes Service (Amazon EKS). Both eliminate the need for you to install and operate your own container orchestration software by managing and scheduling containers on a scalable cluster of virtual machines.
Version release notes
temp
Additional details
Usage instructions
Prerequisites
An AWS account with permissions to create CloudFormation stacks, IAM roles, KMS keys, S3 buckets, ECS services, Lambda functions, and Amazon Cognito user pools.
(Optional) An AWS Certificate Manager certificate in the deployment region for HTTPS.
(Optional) Amazon GuardDuty enabled in the region for malware scanning of uploaded PDFs.
(Optional) Amazon SES verified sender identity for scheduled email-delivered exports.
Launch
From the AWS Marketplace listing, click Continue to Subscribe, accept the EULA, then Continue to Configuration.
Choose your deployment region and click Continue to Launch.
Select Launch CloudFormation as the launch action and click Launch.
Review the parameters and adjust as needed:
DesiredTaskCount - Number of Fargate tasks for the web application (default 1; set to 2 or higher for high availability).
AppOrigin - Browser origin allowed by the uploads bucket CORS policy (default *; tighten to your load balancer DNS or custom domain after the first deploy).
CertificateArn - Optional ACM certificate ARN. When provided, the load balancer enables an HTTPS listener.
Acknowledge the IAM resources notice and click Create stack.
Stack creation takes approximately 12 minutes.
First-time setup
When the stack reaches CREATE_COMPLETE, open the Outputs tab and copy the LoadBalancerDNS value.
Open http://<LoadBalancerDNS> (or your custom domain if HTTPS is configured) in a web browser.
Click Sign up and register the first user with your organization name. This account becomes the organization administrator.
Confirm the email verification code sent to your address.
When prompted, scan the QR code with any TOTP authenticator (Google Authenticator, Authy, 1Password, etc.) to complete MFA enrollment. Sign in. The administrator can now invite additional users from Settings, Users.
Day-to-day usage
Upload bank statements: Navigate to Upload, create or select a Repository ID (RID) case, then drag-and-drop PDF statements into the form. Each statement is automatically scanned for malware, screened for handwriting, and extracted with Amazon Textract.
Review extractions: Open the Repository page, select a document, and use the side-by-side viewer to verify extracted transactions. Click any row to highlight its source location in the PDF. Edit values inline if needed; every change is captured in the audit log.
Run on-demand exports: Navigate to Reports, select an export template, configure filters, and click Export. Generated XLSX or CSV files appear in the export job list with a presigned download link.
Schedule recurring exports: Under Settings, Exports, create a schedule with a cron expression. Exports are delivered as presigned download links or via SES email. Production hardening
After your initial deployment is working, update the stack to set the AppOrigin parameter to your specific origin (for example, http://my-alb-dns.us-east-1.elb.amazonaws.com or https://fde.example.com ). This restricts cross-origin uploads to your domain only. Tear down
Delete the CloudFormation stack from the AWS Console. S3 buckets and the Cognito user pool are configured with RetentionPolicy: Retain to prevent accidental data loss; you must empty and delete those manually after deleting the stack.
Support
Vendor support
Need help? Schedule a support session with our team and we'll get you sorted.
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.