Sure... If the OFX/CSV we upload is encrypted before we upload it, how can you process it ("Leave the rest to us"). Conversely, if you are processing the OFX/CSV, how can you not peek into it?
OFX/CSV files are processed on the client-side, and we never get the raw file, only the processed and encrypted transactions. Does that make sense?