Your money, your data — guarded like a trust.
Two simple rules shape everything here: UniFi can only ever read your accounts, and your data is never anyone's to sell. The rest of this page is the plain-language version of how that holds up.
Encryption by design
Your data is encrypted in transit with TLS and at rest by our database provider. Bank credentials go straight to Plaid — they never pass through, and are never stored on, UniFi's servers. We're moving to managed key encryption (AWS KMS) before general availability, and this page will say so the day it lands.
Read-only by design
UniFi connects to your accounts through Plaid to read balances and transactions. It can never move, send, or withdraw your money — that's a hard architectural limit, not a setting.
Never sold, ever
Your financial data is never sold, never rented, and never used to target ads. No ads, ever — just a simple subscription.
How your bank connection works
Your bank password never touches UniFi's servers.
When you link an account, you sign in through Plaid — the same secure connection layer used by Venmo, Robinhood, and Wealthfront. Your credentials go straight to your bank through Plaid; they never pass through, and are never stored on, UniFi's servers.
Plaid returns a read-only token that lets UniFi see your balances and transactions — nothing more. There is no path, in code or in permission, for UniFi to move a single dollar.
Where we are today
We'd rather earn your trust than overstate it.
UniFi is early, and we won't pretend otherwise. Plenty of apps display badges they've outgrown or never earned; we'd rather tell you where we actually stand. So here it is: SOC 2 Type 2 is in progress, not yet complete — and we're building to that standard from day one rather than waiting for the audit to start behaving like it matters. The practices come first; the certificate follows. When we hold it, we'll say so here, and not a day before.
A promise you can hold us to
Your financial data is yours. We guard it carefully, we never sell it, and we never use it to target ads — not because a regulation says so, but because it's the right way to treat what you've trusted us with.