How Zuren handles security
No software is perfectly secure, and this page won't pretend otherwise. What it does instead is state the specific controls Zuren has — each one is real, in the code, and most are enforced by automated tests that fail the build if a change ever weakens them.
Brokerage connections cannot trade
Brokerage access is read-only at the provider level: the connection Zuren requests can view balances and holdings, and nothing else. There is no order screen, no buy or sell button, and no code path that could place a trade — an automated test scans for one and fails the build if it ever appears. You can disconnect a brokerage at any time from its account page.
No credentials pass through Zuren
Brokerage sign-in happens on the provider's own pages (SnapTrade). Your brokerage username and password are never typed into, seen by, or stored on Zuren. The per-user connection secrets that do exist are encrypted (AES-256-GCM) before they reach the database, with the key held only in server configuration.
Your rows are yours
Every table carries database-level row security scoped to the owning user — the database itself refuses to return another user's rows, even if application code had a bug. An automated test parses every migration and fails if any table ever ships without that protection.
Money is computed, never guessed
Balances are exact integers, converted and totalled with integer arithmetic. No AI model computes or invents any number you see. When a provider's reported total and Zuren's own calculation disagree beyond tolerance, that disagreement is surfaced, not smoothed over.
Payments never touch our servers
If you subscribe, checkout and card entry happen entirely on Stripe's hosted pages. Zuren stores which subscription you hold and its status — never a card number. Subscription state changes are accepted only from cryptographically-signed Stripe messages, verified server-side.
You can leave, completely
Export everything as one JSON file from the dashboard, any time. Delete everything from the dashboard, any time — it removes your financial rows immediately. To remove the account itself, email support@getzuren.com and it will be deleted along with every row tied to it.
Honest limits
Zuren is a small product run by a small team. There is no bug-bounty programme yet, and two-factor authentication is on the roadmap rather than shipped. If you find a security problem, please report it to support@getzuren.com — it will be read by the person who can fix it.