Question 1

What is Sorae?

Accepted Answer

Sorae is a bank statement intelligence API built by Sinneo Financial Technologies. You submit a South African bank statement PDF and receive structured financial intelligence back in under 2 seconds — verified income, expense breakdown, affordability grade (A–F), and risk flags. It is a B2B service designed for lenders, rental agents, employers, and insurers.

Question 2

Who is Sorae built for?

Accepted Answer

Sorae is built for any South African business that needs to assess the financial health of individuals: micro-lenders and NCR-registered credit providers, rental agents and property managers verifying tenant affordability, employers conducting income verification, and insurers and body corporates assessing financial risk.

Question 3

Which banks are currently supported?

Accepted Answer

Capitec Bank is fully supported in the current MVP. FNB, ABSA, Standard Bank, and Nedbank parsers are in active development and will be released in phases. You can track parser status on your dashboard Overview tab.

Question 4

Does Sorae make credit decisions?

Accepted Answer

No. Sorae provides financial analysis and intelligence — it does not make credit decisions and is not a registered credit bureau. The affordability grade, score, and risk flags are tools to assist your decision-making process. The final decision always rests with you as the Responsible Party under the National Credit Act.

Question 5

What does the affordability grade mean?

Accepted Answer

The grade is a composite affordability score mapped to a letter band: A (90–100), B (75–89), C (60–74), D (45–59), F (0–44). The recommended maximum installment is calculated as disposable income × 40%, aligned with NCR affordability guidelines.

Question 6

Does Sorae store bank statement content?

Accepted Answer

Never. Sorae processes bank statements entirely in server memory and discards all statement content immediately after returning the analysis result. No PDF, no extracted text, no transaction records, no account holder names are written to any storage layer at any point. This is a core architectural principle, not just a policy.

Question 7

Is Sorae POPIA compliant?

Accepted Answer

Yes. Sorae is designed around POPIA (Protection of Personal Information Act 4 of 2013). Sinneo Financial Technologies acts as an Information Operator processing data on behalf of its clients, who are the Responsible Parties. All clients must accept a Data Processing Agreement before submitting any statements.

Question 8

What is stored in the audit log?

Accepted Answer

The audit log contains metadata only: a random call ID, the detected bank name, statement period as month/year only (e.g. 2025-01), processing time in milliseconds, response status, your client reference if provided, and a SHA-256 hash of the submitting IP address. No transaction content, no names, no account numbers — ever.

Question 9

Who can see the analysis results?

Accepted Answer

Only the authenticated Sorae account that submitted the request receives the analysis result in the API response. Results are not stored by Sorae after the response is returned. On the manual Analyze tool, results are held in browser sessionStorage which is automatically cleared when the tab is closed.

Question 10

Does anything get sent to OpenAI?

Accepted Answer

The AI summary feature sends structured analysis data to OpenAI GPT-4 — specifically the numeric outputs (income figure, expense totals, affordability score, risk flag codes). Raw transaction descriptions, account holder names, and personal identifiers are never sent to OpenAI.

Question 11

Where is data hosted?

Accepted Answer

Sorae's database runs on Supabase in the af-south-1 region (Cape Town, South Africa), keeping data within South African borders. The application is hosted on Vercel's global edge network. All connections are encrypted with TLS 1.3.

Question 12

How does the billing model work?

Accepted Answer

Sorae uses a prepaid credit wallet. You buy a pack of credits and they are deducted per analysis. There are no monthly fees, no subscriptions, and no contracts. Credits never expire.

Question 13

What credit packs are available?

Accepted Answer

Four packs are available: Starter (R250 for 25 analyses at R10 each), Standard (R500 for 50 analyses at R10 each), Growth (R1,000 for 125 analyses at R8 each), and Pro (R2,500 for 416 analyses at R6 each). Credits never expire.

Question 14

Am I charged for failed analyses?

Accepted Answer

No. Credits are only deducted after a successful analysis. If a statement fails to parse (PARSE_FAILED), the bank is unsupported (UNSUPPORTED_BANK), or any other error occurs, no credits are deducted. You only pay when you receive a valid result.

Question 15

What payment methods are accepted?

Accepted Answer

Payments are processed by PayFast, South Africa's leading payment gateway. Accepted methods include credit and debit cards (Visa, Mastercard), instant EFT from all major SA banks, SnapScan, and Zapper. Sorae never handles or stores your card details.

Question 16

Do credits expire?

Accepted Answer

No. Purchased credits never expire. They remain on your account until used.

Question 17

How do I get a VAT invoice?

Accepted Answer

Your transaction history in the Billing tab shows a full record of all top-ups and deductions. Formal VAT invoices can be requested by emailing support@sorae.co.za with your company name, VAT number, and the relevant payment date.

Question 18

How do I make my first API call?

Accepted Answer

Three steps: (1) Sign up and top up your credit balance. (2) Generate an API key from the API Keys tab in your dashboard. (3) Send a POST request to https://api.sorae.co.za/api/v1/analyze with your key in the Authorization header and a Capitec PDF as the file field. See the Quickstart tab in your dashboard for working code examples in curl, Node.js, and Python.

Question 19

What file formats are supported?

Accepted Answer

Only digital PDF files exported directly from the Capitec app or online banking portal. Scanned images of statements (photographed or flatbed scanned) are not supported — the parser requires machine-readable text embedded in the PDF.

Question 20

What is the maximum file size?

Accepted Answer

The maximum accepted file size is 10MB. Standard Capitec statement PDFs are typically 100–500KB so this limit is rarely reached in practice.

Question 21

How long does an analysis take?

Accepted Answer

Typically between 1.5 and 2.5 seconds end-to-end. Processing time varies with statement length (number of transactions) and AI summary generation. The response includes a processing_ms field so you can measure latency in your integration.

Question 22

What are the rate limits?

Accepted Answer

Default rate limits per API key: 100 requests per minute and 10,000 requests per day. When a rate limit is hit, the API returns HTTP 429 with a Retry-After header. Contact support if you need higher limits.

Question 23

Can I test without using real statements?

Accepted Answer

Yes. Generate a test key (sk_test_...) from your API Keys tab. Test keys behave identically to live keys and still deduct credits, but they are clearly labelled in your logs. We recommend using the Analyze tab in your dashboard for manual testing.

Question 24

What happens when the API returns an error?

Accepted Answer

All errors follow a consistent JSON structure with success: false and an error object containing a code, human-readable message, and call_id. See the Quickstart tab for the complete error code reference with causes and fixes for each code.

Question 25

How do I create an account?

Accepted Answer

Go to sorae.co.za, click Get Started, and complete the three-step signup: enter your details, verify your email with a 6-digit code, and accept the Data Processing Agreement. The whole process takes under 2 minutes.

Question 26

Why do I need to accept a Data Processing Agreement?

Accepted Answer

POPIA (South Africa's data protection law) legally requires a written agreement between the party that processes personal information (Sorae) and the party on whose behalf it is processed (you). This is a one-time step at signup and does not affect how you use the product day-to-day.

Question 27

Can I have multiple API keys?

Accepted Answer

Yes. You can create as many API keys as you need — typically one per integration or environment. Each key has its own label, environment (live or test), and usage statistics. Keys can be revoked individually without affecting others.

Question 28

What happens if I suspect my API key is compromised?

Accepted Answer

Go to the API Keys tab in your dashboard and click Revoke on the affected key immediately. Generate a new key and update your integration. Revoked keys stop working instantly. Email security@sorae.co.za if you need assistance.

Question 29

How do I close my account?

Accepted Answer

Email support@sorae.co.za from your registered account email requesting closure. We will process the request within 5 business days. Any remaining credit balance is non-refundable but we will confirm the exact balance before proceeding.

Frequently Asked
Questions

General

Frequently Asked
Questions

General

Frequently AskedQuestions

General

Frequently AskedQuestions

General

Frequently Asked
Questions

Frequently Asked
Questions