No vague badges. This page describes how UWmatic actually treats your documents and data — and links to the register of every vendor that ever touches it.
Your OM, T-12, P&L, or rent roll is uploaded over TLS. Card data never comes to us at all — payments are entered directly with Stripe.
No rent roll reaches an AI provider with tenant identities attached. Name and contact columns are stripped before extraction, so only the financial fields (rents, balances, occupancy) go on — and a document we cannot handle that way is refused and deleted rather than parsed.
Once extraction finishes, the uploaded document is deleted from our servers — including when extraction fails. We keep the numbers you approved, not the file.
Extracted financials are stored in your account, scoped to you or your organization. Your deals are never visible to other customers and are used only to produce your analysis.
The full detail, including retention periods, is in the privacy policy.
Every data endpoint requires a verified, authenticated session and is rate-limited against a shared, database-backed counter. Admin surfaces sit behind separate, stricter controls.
All traffic is TLS. Data is stored with our infrastructure providers (Supabase, Vercel), who encrypt it at rest.
The rent-roll pipeline strips tenant names and contact details before extraction, and refuses documents it cannot strip. The AI providers we use, and exactly what each receives, are listed in our public subprocessor register.
Billing runs on Stripe. Card details go directly to Stripe and never touch our servers.
Deal share links are frozen snapshots — no login required for the recipient, revocable by you at any time, and excluded from search indexing.
Product analytics load only if you accept analytics cookies. Decline them and those scripts are simply never loaded.
A self-serve export returns your account and property data. No email to support, no waiting.
Account deletion is self-serve and removes your data, with narrow exceptions retained only where the law requires (detailed in the privacy policy).
We keep a public, plainly-worded register of every subprocessor — infrastructure, AI parsing providers, data enrichment, and analytics — including exactly what data each one receives and where it runs. If a vendor isn’t on that list, it doesn’t see your data.
We’re a small company and we’d rather be precise than impressive: UWmatic does not yet hold a SOC 2 attestation. When we complete one, it will be published here.
If your security or compliance team has questions this page doesn’t answer, email support@uwmatic.com and we’ll answer them directly.