Security

your data is safe. full stop.

We built security into Uburu’s foundation — not as an afterthought.

read our practicescontact us

Stripe Payments

PCI-DSS Level 1 certified

Clerk Auth

Enterprise-grade identity

Vercel Edge

Global CDN, DDoS protection

SOC 2 in progress

Type II audit underway

How we protect you

security by design.

Encryption at rest

All data is encrypted at rest using AES-256. Your statement data is stored encrypted, not in plaintext.

TLS in transit

Every request between your browser and our servers uses TLS 1.3. No data travels unencrypted.

Read-only parsing

Uburu only reads files you explicitly upload. We have zero connection to your bank and can write nothing.

Stripe-isolated payments

Card data never touches Uburu servers. Stripe handles it entirely — we only receive a non-sensitive token.

MFA-ready auth

Authentication is powered by Clerk with multi-factor support. Sessions are signed, short-lived, and revocable.

Zero data selling

We do not sell, share, or broker your data for advertising — now or ever. This is a contractual commitment.

Statement handling

what happens to your statement.

Your file never leaves a sandboxed parse environment. Once the AI reads the transactions, the original file is deleted. Only the structured data you can see in the dashboard is retained.

  1. 1You upload a PDF or CSV
  2. 2File is parsed in an isolated environment
  3. 3Raw file is deleted immediately after parse
  4. 4Extracted transactions are encrypted and stored
  5. 5AI reads only structured data — never raw files

Authentication

how authentication works.

Uburu uses Clerk for authentication, a dedicated identity provider — so we never store your password ourselves. Sessions are cryptographically signed and expire automatically.

Multi-factor authentication is available on all accounts. One click to enable — and highly recommended.

Payments

payment processing.

All payments are handled entirely by Stripe — a PCI-DSS Level 1 certified provider. Your card number, CVV, and billing address are entered directly into Stripe’s secure form and never transmitted to Uburu’s servers.

We receive only a non-sensitive payment token. Even if our database were compromised, there is nothing to expose.

FAQ

common questions.

Only you. Our engineers access anonymised, aggregated metrics — never individual user data — and only when required to investigate a reported issue.

questions about our security?

We’re happy to answer any question — no matter how technical.

contact us