How the ledger is built.
And what it won’t do.
The method behind one consolidated set of books: where the numbers come from, why they can be trusted, and the lines it deliberately does not cross.
Accounts that do not talk to each other
Money for one business sits in accounts that do not talk to each other — a US checking account, a Chilean current account, a card in euros. Each bank exports a different shape, in a different number format, with the dates the other way round. Answering what did this cost and did it make money means a spreadsheet, by hand, every month, and being wrong quietly.
Read by a parser or a model, trusted by arithmetic
Upload the statement. CSV, Excel and OFX are parsed exactly. PDFs go to Claude, which handles what a parser cannot — which block of the page is the transaction table, whether 1.234,56 is one thousand or one point two, whether a column headed Cargos is money leaving.
Then arithmetic decides whether to trust it. Every number the model returns is re-parsed into exact integers and the whole extraction is reconciled against the opening and closing balance the statement itself prints. It has to carry one to the other, to the cent, or it does not commit unless you say so — and the check runs against the rows you actually keep, so unticking one is not a way round it. That check is the reason a model is allowed near the ingest path at all.
A statement that prints no balances cannot be checked, and is marked unchecked rather than passed. Every statement keeps its original file, encrypted, one click from the transactions read out of it.
Stamped at commit, never converted at report time
Each transaction is stamped at commit time with its own amount, a USD amount, and the exact rate used — never converted when a report runs. A statement from last March has to read the same today as it did in March.
| Code | Source | USD per unit |
|---|---|---|
| USD | — | 1.0000000000 |
| EUR | European Central Bank, daily | 1.0850000000 |
| CLP | Banco Central de Chile — dólar observado | 0.0011309531 |
The peso publishes on business days only, so a Saturday takes the last published day at or before it — never a later one, or a report would change when re-run the following week.
Rules first, the model second, you last
Rules run first, so a merchant you have confirmed once is never re-decided: it costs nothing and cannot change its mind between runs. The model only sees genuinely new merchants, and what it returns is a suggestion with a confidence that lands in a review queue. Correct one and you are offered the rule that makes the correction permanent.
Transfers between your own accounts are paired and excluded. Moving $10,000 from checking to savings is not ten thousand of income and ten thousand of expense — it is neither, and left unpaired it inflates both sides of every total.
But a category you set by hand outranks the pairing. Money moving between two of your companies can be revenue in one and a cost in the other — a judgement no bank statement can make for you. Unlink a pair and it stays unlinked.
Every total can be taken apart
Cash flow, profit & loss and a balance sheet, in USD, for any period and any one account. Every figure opens the transactions it adds up, and every transaction opens the statement it came from — a total you cannot take apart is a total you cannot check.
A saved report is either pinned to its dates or moves with the calendar, and it says which: “last quarter” and “Q1 2026” are different questions. Balance sheets compare period closes side by side. A transaction you exclude stays in the ledger, and every report it is missing from says so.
Cash basis, and a balance sheet that admits its gaps
It is cash basis. No invoices, no receivables, no accruals. The balance sheet derives cash from the ledger — so the two can never disagree — and takes loans, equipment and owner equity by hand, because no bank statement knows about them.
It therefore does not self-balance, and the gap is reported as an explicit unexplained line rather than plugged. A balance sheet that always balances by construction tells you nothing.
Separate books, a closed door
Each set of books is a workspace, and each company’s books are kept apart from every other. Members are added by email address, as admin or member; admins manage the people and the keys.
Sign-in is Google, behind an allowlist, and an empty allowlist denies everyone — a misconfigured deployment of something holding every transaction in every workspace must not be a public ledger. Statement files are encrypted at rest, the database accepts encrypted connections only, and the service runs with no more permission than it needs.
Stop stitching banks together.
See the whole picture.
MacroAccount is in private beta, by invitation.