PER CURIAM:

Plaintiff-Appellant, Amidax Trading Group ("Amidax"), appeals from a February 17, 2009 judgment of the United States District Court for the Southern District of New York (Castel, J.) dismissing its complaint for lack of subject matter jurisdiction and from the district court's April 23, 2009 order denying Amidax's motion for reconsideration. On appeal, Amidax argues that the district court erred by holding that Amidax lacked standing, by denying jurisdictional discovery, and by denying Amidax leave to amend its complaint. We hold that the district court correctly determined that Amidax did not have Article III standing to assert its claims. Additionally, we hold that the court did not abuse its discretion in denying Amidax's request for jurisdictional discovery and for leave to amend its complaint. Accordingly, we AFFIRM the judgment of the district court dismissing Amidax's complaint for lack of subject matter jurisdiction as well as its order denying Amidax's postjudgment motion for reconsideration.

BACKGROUND

Amidax is a New Jersey-based sole proprietorship that sells household cleaning products to customers throughout the world. Compl. ¶ 10. Based in Belgium, the Society for Worldwide Interbank Financial Telecommunication ("SWIFT") "provid[es] electronic instructions on how to transfer money among 7,800 financial institutions worldwide." Id. Ex. C. Although SWIFT provides a messaging service and is not a bank, it is nonetheless considered the "nerve center of the global banking industry," routing more than 11 million transactions each day "between banks, brokerages, stock exchanges and other institutions." Id.

In response to the September 11, 2001 terrorist attacks the federal government initiated a classified operation known as the Terrorist Finance Tracking Program ("TFTP"). Id. Through the TFTP, operated by the Central Intelligence Agency ("CIA") and overseen by the United States Treasury Department ("Treasury"), the government was granted access to SWIFT records by administrative subpoenas issued by the Office of Foreign Asset Control ("OFAC"). Id. The information requested by the subpoenas allowed the government to search SWIFT's data for "people and institutions suspected of having ties to terrorists." Id. Ex. D.

SWIFT, however, was unable to comply with OFAC's initial subpoenas because it could not "extract the particular information [requested] from [its] broad database." Id. ¶ 1. As a consequence, and notwithstanding that SWIFT was aware the government was seeking access only to information indicating ties to terrorism, SWIFT offered to "give [the government] all the data." Id. This prompted negotiations concerning the appropriate scope of the disclosure of SWIFT data and the extent that privacy safeguards should be implemented to protect the rights of SWIFT customers. Id. Ex. A, C.

Over time the OFAC narrowed the scope of the subpoenas, both with respect to the geographical areas targeted and the type of data requested, and safeguards were instituted to help ensure the data accessed by the government was indeed linked to matters legitimately the subject of terrorism investigations.1 Id. Ex. A. While the TFTP has "allowed counterterrorism authorities to gain access to millions of records of transactions routed through SWIFT," government investigators have used the data to do "at least tens of thousands, maybe hundreds of thousands of searches of people and institutions suspected of having ties to terrorists." Id. Ex D.

Following its discovery of the TFTP, Amidax2 filed its complaint in 2008 against three SWIFT entities,3 the United States Treasury Department, the CIA, and eleven current or former high-ranking federal officials. The complaint asserts claims against all defendants under the First and Fourth Amendments to the United States Constitution and under the Right to Financial Privacy Act, 12 U.S.C. §§ 3401-3422, as well as under state constitutions and various anti-wiretapping, consumer protection, and deceptive trade practices laws. Additionally, the complaint alleges contract and quasi-contract claims against SWIFT. In support of these claims the complaint contains three principal allegations: first, Amidax used the SWIFT network to complete international financial transactions, Compl. ¶ 11; second, SWIFT turned over its entire database to the government pursuant to the TFTP, Compl. ¶ 27; and third, SWIFT turned over records of Amidax's transactions to the government, Compl. ¶ 28. Amidax attached a number of exhibits to the complaint, including two New York Times articles dated June 23 and June 24, 2006 that brought to light the TFTP as well as a DVD of a press conference held by Treasury on June 23, 2006 to explain the program. In response, SWIFT and the federal defendants moved pursuant to Federal Rule of Civil Procedure 12(b)(1) to dismiss the complaint for lack of subject matter jurisdiction.

In February 2009, the district court granted the defendants' motions to dismiss. In arriving at this decision the court first noted that Amidax pleaded the same injury for each cause of action—i.e., that Amidax's financial information was unlawfully obtained by the government from SWIFT. Amidax Trading Grp. v. S.W.I.F.T. SCRL, 607 F.Supp.2d 500, 505 (S.D.N.Y.2009). The court observed that Amidax "either has standing to assert all its claims, or no standing to assert any of them, depending upon whether this injury has been adequately alleged." Id.

After thus framing the standing issue and assuming for the purposes of the motion that Amidax's data was contained in the SWIFT database, the district court concluded that the entirety of the complaint, including the exhibits attached thereto, "fatally undermines the allegation that the government obtained the entire SWIFT database." Id. at 507. Furthermore, the court concluded that Amidax "has not made any showing that the government is now, or ever was, in possession of its financial information." Id. at 508. Accordingly, the court held that because Amidax's complaint "is premised upon conjecture" and "does not allege a concrete and particularized injury," Amidax has failed to allege an injury in fact and therefore lacks standing to sue. Id. The court subsequently denied Amidax's request to conduct jurisdictional discovery as well as its request for leave to amend its complaint. Id. at 509 n. 5.

On March 5, 2009, Amidax filed a motion for reconsideration pursuant to Federal Rules of Civil Procedure 59(e) and 60(b) and Rule 6.3 of the Local Rules of the United States District Courts for the Southern and Eastern Districts of New York, alleging several errors on the part of the district court. The court denied the motion on April 22, 2009 concluding, inter alia, that it did not err in declining to permit jurisdictional discovery because Amidax's "mere speculation that it might have suffered a constitutional injury" does not entitle it to obtain sensitive discovery from either SWIFT or the government. Amidax Trading Grp. v. S.W.I.F.T. SCRL, No. 08 Civ. 5689, 2009 WL 1110788, at *2, 2009 U.S. Dist. Lexis 34845, at *7-8 (S.D.N.Y. Apr. 23, 2009). This appeal followed.

DISCUSSION

I

We review de novo a district court's dismissal of a complaint for lack of subject matter jurisdiction. Celestine v. Mount Vernon Neighborhood Health Ctr., 403 F.3d 76, 79-80 (2d Cir.2005). In conducting this review we note that Amidax bears the burden of establishing standing "in the same way as any other matter on which [it] bears the burden of proof, i.e., with the manner and degree of evidence required at the successive stages of the litigation." Lujan v. Defenders of Wildlife, 504 U.S. 555, 561, 112 S.Ct. 2130, 119 L.Ed.2d 351 (1992). Thus, to survive SWIFT's and the federal defendant's Rule 12(b)(1) motion to dismiss, Amidax must allege facts that affirmatively and plausibly suggest that it has standing to sue. See Selevan v. N.Y. Thruway Auth., 584 F.3d 82, 88 (2d Cir.2009) (citing Ashcroft v. Iqbal, 556 U.S. 662, 129 S.Ct. 1937, 1950, 173 L.Ed.2d 868 (2009)); see also Stalley v. Catholic Health Initiatives, 509 F.3d 517, 521 (8th Cir.2007).

In reviewing a facial attack to the court's jurisdiction, we draw all facts—which we assume to be true unless contradicted by more specific allegations or documentary evidence—from the complaint and from the exhibits attached thereto. See L-7 Designs, Inc. v. Old Navy, LLC, 647 F.3d 419, 422 (2d Cir.2011); see also Sira v. Morton, 380 F.3d 57, 67 (2d Cir.2004) ("A complaint is deemed to include any written instrument attached to it as an exhibit, materials incorporated in it by reference, and documents that, although not incorporated by reference, are integral to the complaint." (citations and internal quotation marks omitted)). In doing so, we construe all reasonable inferences to be drawn from those factual allegations in Amidax's favor. Selevan, 584 F.3d at 88. To the extent that SWIFT's and the federal defendants's Rule 12(b)(1) motion placed jurisdictional facts in dispute—i.e., whether Amidax was a SWIFT customer—the district court properly considered evidence outside the pleadings. See APWU v. Potter, 343 F.3d 619, 627 (2d Cir.2003); see also Morrison v. Nat'l Austl. Bank Ltd., 547 F.3d 167, 170 (2d Cir.2008), aff'd, ___ U.S. ___, 130 S.Ct. 2869, 177 L.Ed.2d 535 (2010).

Under Article III of the Constitution, the jurisdiction of federal courts is limited to the resolution of "cases" and "controversies." U.S. Const. art. III, § 2. "In order to ensure that this `bedrock' case-or-controversy requirement is met, courts require that plaintiffs establish their `standing' as `the proper part[ies] to bring' suit." W.R. Huff Asset Mgmt. Co. v. Deloitte & Touche LLP, 549 F.3d 100, 106 (2d Cir.2008) (alteration in original) (quoting Raines v. Byrd, 521 U.S. 811, 818, 117 S.Ct. 2312, 138 L.Ed.2d 849 (1997)). To establish standing "a plaintiff is constitutionally required to have suffered (1) a concrete, particularized, and actual or imminent injury-in-fact (2) that is traceable to defendant's conduct and (3) likely to be redressed by a favorable decision." Woods v. Empire Health Choice, Inc., 574 F.3d 92, 96 (2d Cir.2009) (citing Lujan, 504 U.S. at 560-61, 112 S.Ct. 2130).

On appeal, Amidax relies chiefly on two allegations in support of its injury in fact argument: 1) that Amidax's financial information was contained within the SWIFT database and 2) that SWIFT turned over its entire database to the government. Based on our review of the complaint, the exhibits attached thereto, and the evidence introduced outside of the pleadings, we agree with the district court that Amidax failed to establish standing. Amidax did not adequately plead an invasion of a legally protected interest which is "concrete and particularized" and "actual or imminent," and not merely "conjectural or hypothetical." See Lujan, 504 U.S. at 560, 112 S.Ct. 2130 (internal quotation marks omitted).

In support of its first factual allegation, that Amidax's financial information was contained in the SWIFT database, Amidax offered the affidavit of its sole proprietor, Marcello Schor, to describe the nature of Amidax's use of the SWIFT network. According to Schor, although Amidax does not have its own SWIFT account number, "for at least the past 15 years" Amidax has "use[d] the SWIFT account number assigned to [its] bank, Commerce Bank, now T.D. Bank, to effect money transfers from Amidax customers through the SWIFT network." He also states that Amidax's individual "account number is regularly. . . attached to the transaction that goes over the SWIFT network." In support of these facts, Schor attached to his affidavit both an Amidax customer invoice dated August 7, 2008, which lists Commerce Bank's SWIFT account number as well as Amidax's individual bank account number, and a letter from Commerce Bank to Amidax, dated May 27, 2008, notifying Amidax of an incoming international wire transfer.

Schor's affidavit, in combination with the complaint's allegations, constitute sufficient support for the general proposition that Amidax used the SWIFT network, albeit indirectly, and that its information was contained in the SWIFT database. This general proposition standing alone, however, is insufficient to make Amidax's alleged injury in fact plausible. Rather, what is missing is factual support for Amidax's allegation that SWIFT handed over Amidax's financial information to the government. Only if such factual support exists, can Amidax nudge its alleged injury from one that is conceivable to one that is plausible. See Iqbal, 129 S.Ct. at 1951.

With regard to this second factual allegation, the record does not support Amidax's conclusion that SWIFT handed over its entire database. In support of this allegation, Amidax relies on the June 23, 2006 New York Times article attached to its complaint in which an anonymous source stated "at first [the government] got everything—the entire SWIFT database." Compl. ¶ 2. On appeal, Amidax argues that the district court erred by making credibility determinations and drawing inferences that undermine, instead of favor, Amidax's allegation. Specifically, Amidax contends that the district court gave preferential credit to certain sources in the article and insufficient weight to the anonymous source who made the crucial statement that the government received the whole SWIFT database. Additionally, Amidax submits that the reasonable inference to be drawn from Treasury Secretary Snow's statement that SWIFT offered to "give [the government] all the data" is that SWIFT in fact turned over its entire database to the government. The district court thus erred, according to Amidax, both by drawing its own factual conclusion that SWIFT did not give the government all its data and by parsing Secretary Snow's statement, which he made at the June 23, 2006 press conference, to the point where no notice pleading could ever be possible.

These arguments lack merit. It is well established that we need not "credit a complaint's conclusory statements without reference to its factual context." Iqbal, 129 S.Ct. at 1954. Furthermore, where a conclusory allegation in the complaint is contradicted by a document attached to the complaint, the document controls and the allegation is not accepted as true. See L-7 Designs, Inc., 647 F.3d 419, 422. Here, Amidax alleges that "sometime after September 11, 2001 SWIFT provided its entire database to the United States Government as part of the TFTP." Compl. ¶ 27. The DVD of Treasury's press conference on June 23, 2006 and the New York Times article dated the same day, both of which were attached to the complaint, undermine the allegation that SWIFT handed over its entire database. First, SWIFT "made clear that it could provide data only in response to a valid subpoena" and "insisted that the data be used only for terrorism investigations." Id. Ex. C. Second, shortly after Secretary Snow made the statement that SWIFT offered to "give [the government] all the data," he clarified what SWIFT meant by this offer.

Id. Ex. A. The factual context of this statement, therefore, contradicts Amidax's allegation that SWIFT indeed followed through with its offer and disclosed the entire database to the government.

Furthermore, Amidax's reliance on a single conclusory statement from an anonymous source that "at first [the government] got everything—the entire SWIFT database" is insufficient to make plausible an allegation that Amidax was somehow injured. As the district court noted, the June 23, 2006 article is based on discussions with "[n]early 20 current and former government officials and industry executives," and there is only one unnamed person quoted as saying that the government initially got "the entire SWIFT database." Compl. Ex. C. In light of the evidence that contradicts this statement—i.e., that some safeguards were initially in place to aid in the government's extraction of data, that SWIFT would provide data to the government only in response to a valid subpoena, and that SWIFT insisted its data be used only for terrorism investigations—and given the sheer amount of information contained in the database, we conclude that Amidax's allegation that SWIFT's entire database was handed over to the government is speculative and conjectural and thus insufficient to establish a basis for Amidax's standing to sue.

While it is clear that the record does not support Amidax's conclusion that SWIFT handed over its entire database, the district court correctly noted that Amidax need not make such a showing in order to allege a plausible injury in fact. "To establish an injury in fact—and thus, a personal stake in this litigation—[Amidax] need only establish that its information was obtained by the government." Amidax Trading Grp., 607 F.Supp.2d at 508. In its reply brief, Amidax notes that a close reading of the documentary evidence reveals that new and tighter safeguards restricting the government's access to SWIFT's data were not implemented until 2003. Amidax submits, therefore, that even if SWIFT did not hand over its entire database, it is nonetheless plausible that SWIFT turned over Amidax's information immediately following the September 11th attacks when the government was "turning on every spigot" it could find in the hope of furthering its terrorism investigations. Compl. Ex C.

We agree with Amidax to the extent that the record is unclear as to what safeguards were in place to screen government access to SWIFT data from 2001 to 2003. Furthermore, given the procedural posture of this case, the exhibits attached to the complaint support some inference that at the outset of the TFTP, the amount of data received by the government was overwhelming and thus more free flowing than after additional safeguards were instituted. Id. Notwithstanding this inference, we hold that Amidax's allegations that its information was turned over by SWIFT to the government, regardless of what post-9/11 period is analyzed, is speculative at best.

As we concluded supra, Amidax has adequately pled that it used the SWIFT network and that its information was contained in the SWIFT database. In its complaint, Amidax specifically alleges that it "was receiving payments, via SWIFT, from its international customers prior to September 11, 2001 and in the weeks and months following that date [and] continuing to the present." Id. ¶ 13. Nowhere, however, does Amidax allege how frequently its customers were transferring payments via SWIFT to its bank account.

Because Amidax's alleged injury in fact is based solely on SWIFT's disclosure of its information to the government and, as we concluded above, Amidax's allegation that SWIFT turned over its entire database to the government is conjectural, for us to determine if a plausible injury in fact exists we need to know if Amidax's customers so frequently utilized the SWIFT network to transfer funds that it is plausible, not just possible, that Amidax's data was handed over. As discussed, SWIFT routes more than 11 million transactions each day "between banks, brokerages, stock exchanges and other institutions." Compl. Ex C. While the June 24, 2006 article states that the TFTP has "allowed counterterrorism authorities to gain access to millions of records of transactions routed through SWIFT," and that government investigators have used the data to do "at least tens of thousands, maybe hundreds of thousands of searches of people and institutions suspected of having ties to terrorists," nothing in the record suggests either how many SWIFT transactions the government obtained from 2001 to 2003 or how many were obtained in the post-2003 period when additional safeguards were present. See Compl. Ex D (internal quotation marks omitted).

We conclude that because Amidax has not alleged more specific details concerning the frequency of its transactions over the SWIFT network, Amidax has not plausibly alleged that it suffered a "concrete, particularized, and actual or imminent injury-in-fact." Woods, 574 F.3d at 96. Although it is possible that SWIFT at some point following the September 11th attacks turned over Amidax's information to the government, for Amidax to have standing to sue, its alleged injury in fact must be plausible. See Iqbal, 129 S.Ct. at 1949 ("The plausibility standard is not akin to a probability requirement, but it asks for more than a sheer possibility that a defendant has acted unlawfully." (internal quotation marks omitted)). Given the number of transactions routed over the SWIFT network on a daily basis, the unresolved ambiguity concerning the number of Amidax transactions in the SWIFT database, and the complete absence of any nexus between Amidax and suspected terrorist activity, Amidax's alleged injury is merely hypothetical and conjectural. It does not rise to the level of being plausible. Because Amidax has failed to allege a plausible injury in fact, the district court properly determined that it lacked subject matter jurisdiction in dismissing the complaint.

II

Amidax also argues that the district court abused its discretion by denying jurisdictional discovery and by denying its request for leave to amend its complaint based on the results of that discovery. Specifically, Amidax contends that the ultimate question of proof as to whether SWIFT disclosed its information to the government lies within the knowledge of SWIFT and the federal defendants. We review a district court's denial of jurisdictional discovery and for leave to amend a complaint for abuse of discretion. Best Van Lines, Inc. v. Walker, 490 F.3d 239, 255 (2d Cir.2007); ATSI Commc'ns, Inc. v. Shaar Fund, Ltd., 493 F.3d 87, 108 (2d Cir.2007).

Although a plaintiff bears the burden of alleging facts that demonstrate its standing, Green Island Power Auth. v. Fed. Energy Regulatory Comm'n, 577 F.3d 148, 159 (2d Cir.2009), "a court should take care to give the plaintiff ample opportunity to secure and present evidence relevant to the existence of jurisdiction." APWU v. Potter, 343 F.3d 619, 627 (2d Cir.2003) (internal quotation marks omitted). As discussed above, however, for Amidax to have plausibly alleged an injury in fact it needed at least to include allegations concerning how frequently its customers were transferring payments via SWIFT to its bank account, and specifically during the 2001-2003 period. As exemplified by the customer invoice attached to Schor's affidavit, Amidax, not the defendants, is in control of the relevant jurisdictional evidence. Thus, Amidax had "ample opportunity to uncover and present evidence relating to the events bearing on the jurisdictional question." See id. In light of this determination, we cannot conclude that the district court abused its discretion in refusing to allow sensitive discovery from SWIFT or the federal defendants based on Amidax's mere speculation that it might have suffered a constitutional injury.

Because we conclude that the district court did not abuse its discretion in denying jurisdictional discovery and because Amidax's challenge on appeal to the district court's denial of its request for leave to amend its complaint is based solely upon Amidax being first able to pursue jurisdictional discovery, it would be futile for us to allow Amidax to amend its complaint. See Advanced Magnetics, Inc. v. Bayfront Partners, Inc., 106 F.3d 11, 18 (2d Cir.1997) ("Leave to amend need not be granted . . . where the proposed amendment would be `futile.'").

CONCLUSION

For the foregoing reasons, we AFFIRM both the judgment of the district court dismissing the complaint and the district court's order denying Amidax's postjudgment motion for reconsideration.