UUseMoneyAI
FeaturesMulti-broker, AI research, paper tradingBrokers8 supported · read-only OAuthCompareUseMoney vs other platformsRoadmapWhat's shipping next 3 monthsChangelogWhat we ship, weekly
Pricing
DocsGet started, brokers, AI, securityGlossaryIndian-markets termsBlogLong reads on Indian markets
Security at UseMoney

We never place trades. And we built the rest of the security posture to match.

Read-only broker OAuth. AES-256-GCM per-user encryption. TLS 1.2+ in transit. Your data is never used to train AI models.

01 / BROKER ACCESS

Read-only. Always.

Every broker connection goes through official OAuth. We never see your password. We literally cannot place an order.

Official OAuth, eight brokers.

Zerodha, Upstox, Angel One, Groww, Dhan, Fyers, HDFC Sky, ICICI Direct. No scrapers, no screen automation — only official broker APIs.

OAuth · read-only scope

No passwords stored. Ever.

We store only the OAuth access token, encrypted. Your broker password never enters UseMoney servers — you log in on the broker's own site and we receive a scoped token.

Token · AES-256 encrypted

Cannot place orders, by design.

The order-placement API scope is never requested. We can only read: holdings, positions, tradebook, MF folios. Nothing else — the broker enforces this, not just our promise.

Scope-restricted · broker-enforced
What this means in practice
  • Your password never leaves the broker's site. You log in on Kite, Groww, HDFC Sky — we are never in that loop.
  • We can only read data the scope allows: holdings, positions, tradebook, MF folios, corporate actions. Nothing else.
  • We cannot place, modify, or cancel orders. The order-placement scope is never requested.
  • Disconnect any time.One click in our app, or directly in the broker's portal. Credentials are removed within seconds.
02 / FLOW

How a broker connection actually works.

The end-to-end OAuth flow, simplified. The broker holds your credentials. We never see them.

broker → usemoney · read-only scope · token encrypted at rest
YOU
Browser
never enters password into UseMoney
→
redirect
BROKER
e.g. Zerodha
login + scope approval
→
read-only token
USEMONEY
Encrypted vault
AES-256-GCM · per-user key
03 / DETAILS

The specifics, by layer.

Encryption

AES-256-GCM, per-user keys.

All sensitive data — broker tokens, contract notes, documents — is encrypted at rest with AES-256-GCM. Encryption keys are per-user, so one compromised key cannot decrypt another user's data.

In transit: TLS 1.2+ everywhere. HSTS enforced.

Infrastructure

Managed database · managed cloud hosting.

Portfolio data is stored with a managed database provider, encrypted at rest and in transit. Market data sits in a short-lived cache (quotes 5 min, historical 1 hr).

Sign-in supports social login and MFA.

What we do NOT do

Three hard nos.

  • We never sell your data. Not to brokers, not to advertisers, not to data aggregators.
  • We never place trades on your behalf. UseMoney is read-only.
  • We never use your portfolio data or chat history to train AI models. Your data is yours.
  • We never share identifiable data with other users.
AI analysis

AI that sees only what it needs.

When you chat with StockSage, your message and the portfolio context the question needs are sent to our AI providers — we never add your name, email or broker credentials. The text of screener questions is sent to them too.

Chat history is stored so you can refer back. It is never used for training. It can be deleted any time from the chat history page.

Data deletion

Your data, your control.

  • Account deletion removes all your data within 30 days.
  • Disconnecting a broker removes its credentials immediately.
  • Individual AI chats can be deleted from the chat history any time.

Full subprocessor list: /subprocessors.

Compliance

Pre-RIA. Honest about it.

We are pre-RIA — SEBI Investment Adviser registration is in motion. We will publish certifications as they are earned. We do not (yet) hold SOC 2 or ISO 27001; we will not claim either until we do.

Reporting a security issue.

If you believe you've found a vulnerability in UseMoney, email security@usemoney.ai. Include reproduction steps. We respond within 48 hours and will keep you updated through remediation.

↳ security@usemoney.ai↳ 48-hour response commitment

Security by architecture,
not by promise.

Read-only OAuth means we don't have the capability to place orders. By design.

Connect a broker safely →Risk disclosure →