How we protect your data

You're trusting us with your money picture, and we take that seriously. USURA.IO is built on companies whose whole job is protecting data: Base44 hosts the app, Plaid connects your bank, and Stripe handles payments. On top of that, we've built the app so other members can never see your information, and a coach sees it only if you choose to share it.

• Your data is encrypted while it travels and while it's stored.
• We never see or store your bank username or password.
• We never see or store your card number when you pay us.
• If a feature needs your Social Security number, like pulling your credit report, we'll tell you why before you enter it, and you choose whether to use that feature.
• We don't sell, rent or share your financial information for marketing or advertising.
• A coach sees your information only if you ask for coaching and turn sharing on, section by section.

USURA.IO runs on Base44, which stores the app's data and runs it. According to Base44's security page:

• Data is encrypted in transit with TLS 1.2 or later, and at rest with AES-256. Backups are encrypted too.
• Base44 holds SOC 2 Type II and ISO 27001 certifications, which are independent audits of its security controls.
• The platform is independently penetration-tested and monitored around the clock by a 24/7 security operations center.
• App data is stored in the United States.
• Secret keys, like the ones that connect us to Plaid and Stripe, are kept in an encrypted vault that only our server can use. They never reach your browser.

When you connect a bank, you sign in through Plaid, not through us. Plaid passes us your account and transaction data with your permission. Your bank username and password are never stored by USURA.IO. According to Plaid's security page:

• Plaid uses AES-256 encryption and TLS.
• Plaid is certified ISO 27001 and ISO 27701, and is SOC 2 compliant.
• Plaid adds its own extra sign-in step when your bank doesn't have one.

You can see and remove any app's access to your accounts at my.plaid.com, and you can remove a bank on the Connect Bank page in USURA.IO at any time, which also ends Plaid's connection for us.

Payments go through Stripe's secure checkout, so your card number never touches USURA.IO. According to Stripe, it's certified PCI Service Provider Level 1, the strictest level in the payments industry, and card numbers are encrypted at rest with AES-256, with the decryption keys kept on separate machines.

• Your data is walled off from other members. The records that hold your money information (charges, income, accounts, cards, loans and scores) can be opened only by your own account, and new records are stamped with your account on our server, not by your browser, so nothing can be filed under someone else. Our administrators can reach member data only through admin tools we use to run, fix and support the service.
• Coaching is opt-in, section by section. A coach sees your information only after you request coaching and turn on sharing for the sections you choose (Dashboard, Budget, Credit Cards). A coach must be assigned to you and pass a second sign-in step before seeing anything (staff coaches also need our approval), and every time a coach opens your information it's recorded. You can turn sharing off at any time.
• Uploads stay private. Statements, pay stubs and screenshots you upload are stored privately, and each viewing link stops working after 5 minutes. Only you can open them, except files you send to us on purpose (support screenshots and offers you submit for review), which our team can open to help you.
• Ask doesn't keep your questions. Questions you ask our money assistant are answered from your own numbers and aren't saved after you leave the page.
• Protected sign-up. Our waitlist uses a bot check and limits on how often codes can be sent.
• Regular security scans. We run Base44's security scan on the app and fix what it finds.

• Turn coaching and sharing on or off anytime on your Profile page.
• Remove a bank on the Connect Bank page, or remove access at my.plaid.com.
• Read exactly what we collect and why in our Privacy Policy.
• Questions or concerns? Reach us through the Support page, and we'll answer.

Provider details come from each company's own published security information, as of the date above:

• Base44 security and Base44 security overview
• Plaid security and Plaid safety
• Security at Stripe

No system is perfectly secure. If we ever learn your information was exposed, we'll tell you what happened and what we're doing about it.