UUseMoneyAI
FeaturesMulti-broker, AI research, paper tradingBrokers8 supported · read-only OAuthCompareUseMoney vs other platformsRoadmapWhat's shipping next 3 monthsChangelogWhat we ship, weekly
Pricing
DocsGet started, brokers, AI, securityGlossaryIndian-markets termsBlogLong reads on Indian markets
Security at UseMoney

We never place trades. And we built the rest of the security posture to match.

Read-only broker OAuth. AES-256-GCM per-user encryption. TLS 1.2+ in transit. Your data is never used to train AI models.

01 / BROKER ACCESS

Read-only. Always.

Every broker connection goes through official OAuth. We never see your password. We literally cannot place an order.

Official OAuth, eight brokers.

Zerodha Kite Connect, Upstox API, Angel One SmartAPI, Groww API, Dhan API, Fyers API, HDFC Sky, ICICI Direct. No scrapers, no screen automation — only official broker APIs.

OAuth · read-only scope

No passwords stored. Ever.

We store only the OAuth access token, encrypted. Your broker password never enters UseMoney servers — you log in on the broker's own site and we receive a scoped token.

Token · AES-256 encrypted

Cannot place orders, by design.

The order-placement API scope is never requested. We can only read: holdings, positions, tradebook, MF folios. Nothing else — the broker enforces this, not just our promise.

Scope-restricted · broker-enforced
What this means in practice
  • Your password never leaves the broker's site. You log in on Kite, Groww, HDFC Sky — we are never in that loop.
  • We can only read data the scope allows: holdings, positions, tradebook, MF folios, corporate actions. Nothing else.
  • We cannot place, modify, or cancel orders. The order-placement scope is never requested.
  • Disconnect any time.One click in our app, or directly in the broker's portal. Credentials are removed within seconds.
02 / FLOW

How a broker connection actually works.

The end-to-end OAuth flow, simplified. The broker holds your credentials. We never see them.

broker → usemoney · read-only scope · token encrypted at rest
YOU
Browser
never enters password into UseMoney
→
redirect
BROKER
e.g. Kite
login + scope approval
→
read-only token
USEMONEY
Encrypted vault
AES-256-GCM · per-user key
03 / DETAILS

The specifics, by layer.

Encryption

AES-256-GCM, per-user keys.

All sensitive data — broker tokens, contract notes, documents — is encrypted at rest with AES-256-GCM. Encryption keys are per-user, so one compromised key cannot decrypt another user's data.

In transit: TLS 1.2+ everywhere. HSTS enforced.

Infrastructure

MongoDB Atlas · Google Cloud · Vercel.

Portfolio data stored in MongoDB Atlas (encryption at rest + TLS in transit). Hosted on Google Cloud Platform (us-central1) and Vercel. Market-data cache in Redis with short TTLs (quotes 5 min, historical 1 hr).

Authentication via Clerk — supports OAuth social login and MFA.

What we do NOT do

Three hard nos.

  • We never sell your data. Not to brokers, not to advertisers, not to data aggregators.
  • We never place trades on your behalf. UseMoney is read-only.
  • We never use your portfolio data or chat history to train AI models. Your data is yours.
  • We never share identifiable data with other users.
AI engine

Google Gemini via Vertex AI.

The production AI engine is Google Gemini, accessed via Google Vertex AI (us-central1). When you chat with StockSage, anonymised portfolio context (symbol + quantity, never your name, email, or broker credentials) is sent to Gemini for the response.

Chat history is stored so you can refer back. It is never used for training. It can be deleted any time from the chat history page.

Data deletion

Your data, your control.

  • Account deletion removes all your data within 30 days.
  • Disconnecting a broker removes its credentials immediately.
  • Individual AI chats can be deleted from the chat history any time.

Full subprocessor list: /subprocessors.

Compliance

Pre-RIA. Honest about it.

We are pre-RIA — SEBI Investment Adviser registration is in motion. We will publish certifications as they are earned. We do not (yet) hold SOC 2 or ISO 27001; we will not claim either until we do.

Reporting a security issue.

If you believe you've found a vulnerability in UseMoney, email security@usemoney.ai. Include reproduction steps. We respond within 48 hours and will keep you updated through remediation.

↳ security@usemoney.ai↳ 48-hour response commitment

Security by architecture,
not by promise.

Read-only OAuth means we don't have the capability to place orders. By design.

Connect a broker safely →Risk disclosure →