Trust & Security
A financial tool is only as good as the trust behind it. This page explains — in plain language, without marketing fog — exactly how we protect your information and what we deliberately choose not to do.
Last updated: July 2, 2026
Where we are today: Umbra Pay is in pre-launch. It is a personal-finance planning tool — it does not hold, move, or transfer real money, and it does not connect to your real bank account. The numbers you enter are used to plan how you'd route a paycheck, and nothing more. We tell you this first because honesty about what we don't do is part of earning your trust.
How your data is protected
These are the controls that are live in production right now:
✓ Database-level access control
Every table enforces row-level security: the database itself guarantees each account can only ever read its own data — not just the app code, the database engine. It's the strongest place to enforce this.
✓ Encrypted everywhere
All traffic uses HTTPS (TLS 1.2+) with HSTS enforced, and your data is encrypted at rest in the database. Nothing travels or sits in the clear.
✓ We never see your password
Passwords are stored as a salted, one-way hash by our authentication provider. We cannot read it, and neither can anyone who works on Umbra.
✓ No secrets in your browser
Sensitive keys live server-side only. The public app ships with nothing that could be used to reach another user's data.
✓ Hardened application
Browser security headers (anti-clickjacking, MIME-sniffing protection), continuous error monitoring, and administrative actions that are access-gated and logged to an audit trail.
✓ Audited infrastructure
Umbra runs on Supabase and Vercel — providers that maintain independent SOC 2 Type II compliance for the platforms we build on.
What we deliberately don't do
- We don't move or hold your money. Umbra is a planning tool, not a bank, broker, or payment processor.
- We don't connect to your bank or store account numbers. We never collect your SIN, government ID, or real transaction data.
- We don't sell your data — ever — and we don't use it to train AI models.
- We don't run third-party advertising trackers. Our usage analytics are cookieless and aggregate.
Your data, your rights
Umbra is operated from Canada and follows Canadian privacy law (PIPEDA). Wherever you live, you can:
- Access a copy of the data we hold about you
- Correct anything inaccurate
- Delete your account and have your data removed
- Export your data in a portable format
To exercise any of these, email support@umbrapay.ca from your account address. Full detail is in our Privacy Policy.
Who helps us run Umbra
We use a small, deliberately short list of reputable providers. Each processes only what it needs to, and none receives more than its job requires:
- Supabase — database & authentication (your account and planning data, encrypted).
- Vercel — application hosting and delivery.
- Anthropic — powers the optional "Get AI insight" feature, and only when you click it.
- Resend — sends transactional email (password resets, confirmations).
- Upstash — anonymous rate-limit counters that help prevent abuse.
Found a security issue?
We welcome responsible disclosure. If you believe you've found a vulnerability, please email support@umbrapay.ca with the details and steps to reproduce. We'll acknowledge you, investigate promptly, and won't pursue good-faith researchers who follow this process. See our security.txt.
Our commitment
Security is never "done." As Umbra grows we are actively adding optional multi-factor authentication, formalizing our incident-response process, and will pursue formal independent certification when the stage calls for it. We'd rather tell you what we're still building than pretend we've finished.
For financial advisors
Considering recommending Umbra to a client? Here's the short version: Umbra is a planning tool (not advice, and it doesn't touch real money), client data is protected by the database-level and encryption controls above, and we're glad to walk through our posture or complete a security questionnaire.
Reach us directly at support@umbrapay.ca.
Umbra Pay is a pre-launch personal-finance planning and routing tool. It is not a bank, broker, payment processor, or registered financial advisor, and it does not hold, move, or transfer real funds. This page describes our current security practices for transparency and does not constitute a warranty or legal advice.