How Zuren handles security
No software is perfectly secure, and this page won't pretend otherwise. What it does instead is state the specific controls Zuren has — each one is real, in the code, and most are enforced by automated tests that fail the build if a change ever weakens them.
Zuren cannot place trades or move money.
Your rows are yours
Every table carries database-level row security scoped to the owning user — the database itself refuses to return another user's rows, even if application code had a bug. An automated test parses every migration and fails if any table ever ships without that protection.
Money is computed, never guessed
Balances are exact integers, converted and totalled with integer arithmetic. No AI model computes or invents any number you see. When a provider's reported total and Zuren's own calculation disagree beyond tolerance, that disagreement is surfaced, not smoothed over.
Export and deletion controls
Download a portfolio export: accounts, balances, holdings, connection status, sync history, repayment schedules, Bills (saved obligations, not payments), saved goals, radar and consent records, and your journal, spending, goal progress, manual holdings and review records. Until a feature has been set up on Zuren's service, its section is marked unavailable, never shown as empty; after that, your records are included even while the feature is switched off. It excludes your financial profile, preferences, financial events and activities, AI records, billing records, credentials, operator audit records, feedback you sent with Give feedback, and your product-analytics and setup-tip choices. Corrections and removals of transactions, holdings and recorded goal progress add a new version and keep the earlier ones. Removing a saved goal deletes its recorded progress. Clear manual accounts deletes manually entered accounts and their attached history, imports, schedules and manual holdings; spending records stay. Institution names, profile, preferences, radar, financial events and activities, AI, legal, billing and audit records remain. Contact support@getzuren.com for account closure and provider disconnection; applicable retention will be explained.
Honest limits
Zuren is a small product run by a small team. There is no bug-bounty programme yet, and two-factor authentication is on the roadmap rather than shipped. If you find a security problem, please report it to support@getzuren.com — it will be read by the person who can fix it.