Security & Data Handling

You upload confidential deal financials. Here’s exactly what happens to them.

No vague badges. This page describes how UWmatic actually treats your documents and data — and links to the register of every vendor that ever touches it.

The life of an uploaded document

1

Encrypted in transit

Your OM, T-12, P&L, or rent roll is uploaded over TLS. Card data never comes to us at all — payments are entered directly with Stripe.

2

Parsed, with PII stripped first

No rent roll reaches an AI provider with tenant identities attached. Name and contact columns are stripped before extraction, so only the financial fields (rents, balances, occupancy) go on — and a document we cannot handle that way is refused and deleted rather than parsed.

3

The file is deleted

Once extraction finishes, the uploaded document is deleted from our servers — including when extraction fails. We keep the numbers you approved, not the file.

4

Your data stays yours

Extracted financials are stored in your account, scoped to you or your organization. Your deals are never visible to other customers and are used only to produce your analysis.

The full detail, including retention periods, is in the privacy policy.

How the platform is built

Authenticated API, end to end

Every data endpoint requires a verified, authenticated session and is rate-limited against a shared, database-backed counter. Admin surfaces sit behind separate, stricter controls.

Encrypted in transit and at rest

All traffic is TLS. Data is stored with our infrastructure providers (Supabase, Vercel), who encrypt it at rest.

Tenant PII never reaches AI models

The rent-roll pipeline strips tenant names and contact details before extraction, and refuses documents it cannot strip. The AI providers we use, and exactly what each receives, are listed in our public subprocessor register.

We never see your card

Billing runs on Stripe. Card details go directly to Stripe and never touch our servers.

Share links you control

Deal share links are frozen snapshots — no login required for the recipient, revocable by you at any time, and excluded from search indexing.

Analytics only with consent

Product analytics load only if you accept analytics cookies. Decline them and those scripts are simply never loaded.

Export everything, any time

A self-serve export returns your account and property data. No email to support, no waiting.

Delete everything, any time

Account deletion is self-serve and removes your data, with narrow exceptions retained only where the law requires (detailed in the privacy policy).

Who else touches your data

We keep a public, plainly-worded register of every subprocessor — infrastructure, AI parsing providers, data enrichment, and analytics — including exactly what data each one receives and where it runs. If a vendor isn’t on that list, it doesn’t see your data.

Where we are on certifications

We’re a small company and we’d rather be precise than impressive: UWmatic does not yet hold a SOC 2 attestation. When we complete one, it will be published here.

If your security or compliance team has questions this page doesn’t answer, email support@uwmatic.com and we’ll answer them directly.