Question 1

What is Sorae?

Accepted Answer

Sorae is a bank statement intelligence API built by Sinneo Financial Technologies. You submit a South African bank statement PDF and receive structured financial intelligence back in under 3 seconds — verified income, expense breakdown, affordability grade (A–F), and risk flags. It is a B2B service designed for lenders, rental agents, employers, and insurers.

Question 2

Who is Sorae built for?

Accepted Answer

Sorae is built for any South African business that needs to assess the financial health of individuals: micro-lenders and NCR-registered credit providers, rental agents and property managers verifying tenant affordability, employers conducting income verification, and insurers and body corporates assessing financial risk.

Question 3

Which banks are currently supported?

Accepted Answer

All five major South African banks are fully supported: Capitec, FNB, ABSA, Standard Bank, and Nedbank — covering both branch-issued and internet-banking PDF statement formats.

Question 4

Does Sorae make credit decisions?

Accepted Answer

No. Sorae provides financial analysis and intelligence — it does not make credit decisions and is not a registered credit bureau. The affordability grade, score, and risk flags are tools to assist your decision-making process. The final decision always rests with you as the Responsible Party under the National Credit Act.

Question 5

What does the affordability grade mean?

Accepted Answer

The grade is a composite affordability score mapped to a letter band: A (90–100), B (75–89), C (60–74), D (45–59), F (0–44). The recommended maximum installment is calculated as disposable income × 40%, aligned with NCR affordability guidelines.

Question 6

Can Sorae detect tampered or fraudulent bank statements?

Accepted Answer

Yes — every analysis runs 13 document-integrity checks that flag signs of tampering. The checks cover three areas: document forensics (edit traces from incremental saves, font substitution and subset anomalies, PDF metadata, template match, creation date versus statement period), ledger integrity (declared closing balance, opening-to-closing reconciliation, balance continuity), and timeline consistency (future or out-of-period dates, unexplained gaps). When high-severity signals are raised, the report shows a Document Integrity Alert and the affordability verdict is suppressed until a fresh bank-generated PDF is submitted. Sorae flags signs of tampering — it does not certify a document as genuine.

Question 7

What is the statement ledger?

Accepted Answer

The statement ledger is the full list of transactions Sorae reconstructed from the PDF — every date, description, amount, and balance — searchable and filterable by category. It lets a credit officer trace any figure in the report back to the underlying transactions, and it powers the ledger-integrity checks such as balance reconciliation and continuity.

Question 8

Does Sorae store bank statement content?

Accepted Answer

The bank statement document itself is never stored: PDFs and extracted raw text are processed entirely in server memory and discarded immediately after analysis. The structured analysis result — including derived income figures, risk flags, and the reconstructed transaction ledger — is retained under your account so reports can be reopened from your dashboard. Stored results are accessible only to your account, can be deleted on request, and are permanently deleted when your account is deleted.

Question 9

Is Sorae POPIA compliant?

Accepted Answer

Yes. Sorae is designed around POPIA (Protection of Personal Information Act 4 of 2013). Sinneo Financial Technologies acts as an Information Operator processing data on behalf of its clients, who are the Responsible Parties. All clients must accept a Data Processing Agreement before submitting any statements.

Question 10

What is stored in the audit log?

Accepted Answer

The audit log contains metadata only: a random call ID, the detected bank name, statement period as month/year only (e.g. 2025-01), processing time in milliseconds, response status, your client reference if provided, and a SHA-256 hash of the submitting IP address. No transaction content, no names, no account numbers — ever.

Question 11

Who can see the analysis results?

Accepted Answer

Only the authenticated Sorae account that submitted the request. The analysis result is returned in the API response and stored against your account so you can reopen it later from your dashboard logs. Stored reports are visible only to your account, can be deleted on request, and are permanently deleted when your account is deleted.

Question 12

Does anything get sent to AI providers?

Accepted Answer

Yes — one thing only: the AI summary feature sends structured numeric outputs (income figure, expense totals, affordability score, risk flag codes) to Anthropic's Claude API. Raw transaction descriptions, account holder names, and personal identifiers are never sent to any AI provider.

Question 13

Where is data hosted?

Accepted Answer

Sorae's database runs on Supabase in the af-south-1 region (Cape Town, South Africa), keeping data within South African borders. The application is hosted on Vercel's global edge network. All connections are encrypted with TLS 1.3.

Question 14

How does the billing model work?

Accepted Answer

Sorae uses a prepaid credit wallet. You buy a pack of credits and they are deducted per analysis. There are no monthly fees, no subscriptions, and no contracts. Credits never expire.

Question 15

What credit packs are available?

Accepted Answer

Three packs are available: Starter (R300 for 20 analyses at R15 each), Growth (R1,000 for 100 analyses at R10 each), and Scale (R4,000 for 500 analyses at R8 each). Credits never expire.

Question 16

Am I charged for failed analyses?

Accepted Answer

No. Credits are only deducted after a successful analysis. If a statement fails to parse (PARSE_FAILED), the bank is unsupported (UNSUPPORTED_BANK), or any other error occurs, no credits are deducted. You only pay when you receive a valid result.

Question 17

What payment methods are accepted?

Accepted Answer

Sorae accepts credit and debit cards (Visa, Mastercard), instant EFT from all major SA banks, SnapScan, and Zapper. All payments are processed by PayFast, South Africa's leading payment gateway — Sorae never handles or stores your card details.

Question 18

Do credits expire?

Accepted Answer

No. Purchased credits never expire. They remain on your account until used.

Question 19

How do I get a VAT invoice?

Accepted Answer

Email support@sorae.co.za with your company name, VAT number, and the relevant payment date to request a formal VAT invoice. Your transaction history in the Billing tab shows a full record of all top-ups and deductions.

Question 20

How do I make my first API call?

Accepted Answer

Three steps: (1) Sign up and top up your credit balance. (2) Generate an API key from the API Keys tab in your dashboard. (3) Send a POST request to https://sorae.co.za/api/v1/analyze with your key in the Authorization header and a bank statement PDF as the file field. See the Quickstart tab in your dashboard for working code examples in curl, Node.js, and Python.

Question 21

What file formats are supported?

Accepted Answer

Only digital PDF files exported directly from the bank's app or online banking portal. Scanned images of statements (photographed or flatbed scanned) are not supported — the parser requires machine-readable text embedded in the PDF.

Question 22

What is the maximum file size?

Accepted Answer

The maximum accepted file size is 10MB. Standard bank statement PDFs are typically 100–500KB so this limit is rarely reached in practice.

Question 23

How long does an analysis take?

Accepted Answer

Typically between 1.5 and 2.5 seconds end-to-end. Processing time varies with statement length (number of transactions) and AI summary generation. The response includes a processing_ms field so you can measure latency in your integration.

Question 24

What are the rate limits?

Accepted Answer

Default rate limits per API key: 100 requests per minute and 10,000 requests per day. When a rate limit is hit, the API returns HTTP 429 with a Retry-After header. Contact support if you need higher limits.

Question 25

Can I test without using real statements?

Accepted Answer

Yes. Generate a test key (sk_test_...) from your API Keys tab. Test keys behave identically to live keys and still deduct credits, but they are clearly labelled in your logs. We recommend using the Analyze tab in your dashboard for manual testing.

Question 26

What happens when the API returns an error?

Accepted Answer

All errors follow a consistent JSON structure with success: false and an error object containing a code, human-readable message, and call_id. See the Quickstart tab for the complete error code reference with causes and fixes for each code.

Question 27

How do I create an account?

Accepted Answer

Go to sorae.co.za, click Get Started, and complete the three-step signup: enter your details, verify your email with a 6-digit code, and accept the Data Processing Agreement. The whole process takes under 2 minutes.

Question 28

Why do I need to accept a Data Processing Agreement?

Accepted Answer

POPIA (South Africa's data protection law) legally requires a written agreement between the party that processes personal information (Sorae) and the party on whose behalf it is processed (you). This is a one-time step at signup and does not affect how you use the product day-to-day.

Question 29

Can I have multiple API keys?

Accepted Answer

Yes. You can create as many API keys as you need — typically one per integration or environment. Each key has its own label, environment (live or test), and usage statistics. Keys can be revoked individually without affecting others.

Question 30

What happens if I suspect my API key is compromised?

Accepted Answer

Go to the API Keys tab in your dashboard and click Revoke on the affected key immediately. Generate a new key and update your integration. Revoked keys stop working instantly. Email security@sorae.co.za if you need assistance.

Question 31

How do I close my account?

Accepted Answer

Email support@sorae.co.za from your registered account email requesting closure. We will process the request within 5 business days. Any remaining credit balance is non-refundable but we will confirm the exact balance before proceeding.

Frequently Asked
Questions

General

Frequently Asked
Questions

General

Frequently AskedQuestions

General

Frequently AskedQuestions

General

Frequently Asked
Questions

Frequently Asked
Questions