Hi Everyone! I posted this AMA to Reddit and wanted to cross-post it here to answer any questions you might have about connected accounts, verified shareholder communities, my hair care routine, and anything else!

I want to emphasize one thing that I will repeat below - Urvin does not have access to any user credentials, we never have (and don't want to), and all broker connections are strictly read-only.

I'll answer the top questions from the AMA thread in this post, and am happy to answer any others in the comments. Ultimately, the most important part worth highlighting segues perfectly to our first AMA question - our ongoing contact with Computershare - so here we go:

Q: Has Urvin had any contact with Computershare regarding linking user's accounts to your platform? If so, what kind of response did you receive, and roughly when was the contact?

• A: Great question, and really one that needs more attention: YES, Urvin is currently engaged in a dialogue with Computershare on this exact capability and Computershare, like Urvin, is very excited about the possibilities it advances. In fact, immediately after concerns by the community were raised last week we reached out to our friends at Computershare - of which there are many - and asked them if, indeed, MX is the best existing pathway for linking Computershare accounts to Urvin, and just this morning we spoke with them and they said unequivocally, yes. Computershare knows that they could provide a better interface to authenticate users and holdings, and together we plan to implement those solutions over time, but for where things currently stand we were encouraged to allow users to connect via MX. We’re quite fortunate that Computershare and Urvin have such a longstanding, close and positive relationship, and we’re all looking forward to seeing where it can grow.

Q: Have you directly registered your shares in book form?

• A: Yes, and I was one of the few people who was publicly revealed last year to have DRS’d, by a group of highly-engaged community members who reviewed the official ledger.

Q: How did Dave get the funding? Were the email sign-ups ( 20K iirc) used to attract investors?

• A: Much of our funding has come from individuals through our two Reg CF crowdfunding raises. We have over 2k individual investors in our company, and we communicate with them almost every month. This platform is truly built by, and for individual investors. The rest of our funding has come from accredited investors directly into the company (not through Reg CF). 

Q: What makes storing credentials with MX safe? Keep in mind that “other companies do it too” is not enough.

• A: MX has the strongest security practices of any of our partners and the longest track record. They are both SOC 2 and PCI DSS compliant, and have been in business for over 10 years. Everything is encrypted in-transit and at-rest. We feel very comfortable with their approach to security, I’d encourage you to review it here: https://www.mx.com/trust/

• A: I’d note that if you’re not comfortable with MX security practices, you should probably also reexamine most all other relationships you have with financial institutions, because MX has bank-level security. I’d also note that Computershare themselves have encouraged us to use MX to provide this functionality to our users.

Q: This seems, coupled with the TOS update from ComputerShare for third-party apps, like this is going to be a info-sharing/enabling exchange not too far off the parallel with CEX platforms on the blockchain. Only what is being proofed here is credentials of Transfer Agent custody, not the mining and subsequent exchange transactions. But if you willing give the key infornation with say cryptonite .. not your keys, not your shares

This platform needs ultra-secure safeguards, how is this possible? Has any establish internet or encrytion standards vetted a platform like this with securities data? (other than discussing the packet and communication aspects of it)

• You are right - security standards are absolutely critical. However, we have taken one important step to mitigate any possible harm - all of our partner integrations are strictly read-only. I want to repeat that one more time for emphasis: All of our partner integrations are strictly read-only.  In fact, most of our partners only offer read-only functionality - they do not even attempt to do anything else. They have recognized, as have you, that it can be dangerous to create any additional functionality. That being said, Urvin holds ourselves to a high standard, and we recognize the attention we’re getting and the importance of safeguarding user data. We have been pen tested to the OSSTMM standard, a globally recognized security standard recognized by governments and standard bodies such as the NIST as an excellent approach to information security. We will continue to adhere to this standard, and will continue to improve our practices. The underlying framework our platform is built on is called ABP.io and is an open source platform that has been rigorously vetted and tested.

Q: I see Urvin is collecting data on how many shares are outstanding. When will this data be made public?
Edit to add: If it becomes blatantly clear that a particular stock is shorted multiple times over, what steps would Urvin take? Would you release this information publicly, or report to regulatory bodies for further guidance? How would you respond if said regulatory bodies coerced you not to publicize the real share count, even if your users who are security holders requested their positions be aggregated and publicly disclosed?

• A: In our database, for some brokers we have position-level data (how many shares someone holds) and for some brokers we have transaction-level data (how many shares were acquired when, and for what price). This gives us the ability to quantify how many shares in total have been authenticated as being held by our users. It also lets us tag users to show how long they have been holding a stock, which we think is a better social proof point than how many shares they’re holding. Urvin will likely publish the number of shares that are held on the platform in individual verified shareholder communities. We have no reason to think a regulatory body would be opposed to this, but unless we are breaking a law, there would be no action they could take to prevent us from publishing this information.

Q: Wasn’t there a TOS update on Computershare about collecting and sharing information? Not gonna do this at all nor does anyone need to. It won’t benefit anyone to know how many DRS’s shares are there when we already know this info from GameStop’s reports itself directly.

• A: The only thing we see in Computershare’s TOS were about their use of data aggregators. As mentioned before, they have affirmatively encouraged us to use MX to provide this functionality to our users. There is no TOS violation here.

• I think it’s important to understand the primary reason we are offering this service - a share count is simply a byproduct of verified shareholder communities, not a primary feature. We want to build communities in which you can be sure the people you’re interacting with are real people and real shareholders. It would be a shame if we could not authenticate DRSed holders. Now we know that we can do it technically, and we’ve done our due diligence to make sure that we can do it securely. We feel comfortable with the security standards our partners are using, and we’ve tried to provide as much transparency as possible so that our users can make their own informed decisions.

Q (shortened for readability, linked to another post): Did you know that SnapTrade gets granted FULL account access and that all the information is by default shared with all the partners using the service AND do you have a top notch cyber security team as Urvin would become a mighty juicy target for cyber attacks and ACCEPT all liabilities with using this API service provider?

Dave better have a top notch security system and cyber defense as your information is shared with every partner on the platform

The disclaimer though: USE OF THE SERVICES IS AT END USER’S OWN RISK.

• A: First of all, I do not blame you for being extremely concerned at having read something like that - I would be too. However, I want to assure you that at NO TIME did SnapTrade ever have any control over anything in your account. As I said earlier: All of our broker connections are strictly read-only, including those through SnapTrade. SnapTrade included those disclaimers in the connection dialog in order to accommodate a potential future use case of theirs (not ours) that could involve trading. However, that functionality does not exist, and has never existed. They have changed their prompts and their Terms of Service to reflect the fact that all SnapTrade connections are strictly read-only in part because of your feedback. Thank you for bringing this to our attention - we worked with the vendor, made sure our beliefs were correct (that the connection was, and has always been read-only), and made sure they fixed the issues on their side.

Q: Why do you think, did you not get banned from the stonk after your obvious phishing attempt and got an AMA instead? What is your relationship with the mods? Why was it Computershare login details that you were 'testing' with? How much people entered their info and will you inform them to change their password after doing this? Your system will fail if not everyone participates, it wasn't exactly received well. What use is it now?There's a publicly available ledger on which all true (DRS'd) shareholders are mentioned, what advantage does your system have over that ledger?Why are you not mentioned on that Ledger? Does Citadel or any other financial institution pay you in any way shape or form, directly or indirectly?

• A: I’ll answer your questions in order:

• There was no phishing attempt in any way, which is probably why I wasn’t banned. We did not try to mislead anyone into giving us their credentials, we released a feature on a website that many other websites offer. At no time did we have access to, or visibility into anyone’s credentials, nor would we want that.

• I have no relationship with the mods other than mutual respect. They are generally very supportive of our advocacy efforts with We The Investors and they have gotten to know me well over the last couple of years. I’ve proved myself to them through both word and action. I ask them before I post to make sure that what I’m going to post does not violate any rules, and will work with them to address any concerns.

• We support many different broker connections, Computershare was not the first to be tested. We can only test connections in prod, and so we pushed it in order to test the final steps.

• 44 people entered their info (I think I said 16 before, but it was 44 total - 16 kept their accounts connected), and I have personally reached out to every one of them.

• The idea of a brokerage share count (in contrast to a ledger share count) is not binary. If there is indeed an unknown but voluminous quantity of phantom shares, then to find them via a brokerage count not every share needs to be accounted for, just more than the available float. Think about that, it doesn’t require everyone, it’s not all or nothing, it just requires enough. And that’s powerful. But that’s beside the point: I think we will be successful as people learn about verified shareholder communities and how important it is to get away from massive bot networks. Our experience with the FUD spread about our Computershare connection only reinforced this belief, and showed how important this is. Now more than ever we need social platforms with real, verified people.

• As I mentioned above, the advantage we have over the ledger is that we can authenticate anyone, regardless of who they’re holding their securities with, and can create a social platform of verified shareholders. Our goal is to bring everyone together regardless of where or how they hold their investments, and we think our approach - versus simple ledger reporting - does that.

• I think you’re misinformed. As mentioned above, I was one of the only people who was actually identified by name as being on the ledger last year.

• Simple: No.

Q: Dear Dave, As of this moment, the queries surrounding the request of Computershare login data have shifted dramatically, thanks to the inability to select Computershare any longer on your site. Thus it rules out any purpose of a unified forum, if DRS is no longer accepted. On top of that, Computershare explicitly stated that any third-party app is not authorized to request login information, and as such makes your attempts at such technically illegal. Therefore, does this mean your project is dead-on-arrival?

• A: We have re-activated Computershare login, and will soon be adding many other new brokers that have been requested. No, I don’t think our project is dead-on-arrival - I think the FUD that resulted from the initial Computershare rollout proves that what we’re doing is more important than ever.

Q: Dave, did you incentivize moderators here on Reddit (financially or otherwise) to allow you to promote your private business here on Reddit?

• A: No. And I would argue that we are not promoting a private business, we are spreading the word on a new technology that shareholders are interested in. The service we offer is completely free if you only use it to join verified shareholder communities, and that’s the only thing we’re talking about here.

Q: Even if only testing, I'm sure you have metrics. How many users logged into their CS accounts via your platform? Will you alert those individuals and emphasize they should change their login information due to it being a test environment and not verified secure? Why would you do this in production and not internal? Why do you consider this method of linking accounts safe and best for users? Would you trustingly enter your financial information if you were in our shoes? Does Urvin legally assume any responsibility for instances of security breaches, user data doxing, or stolen property? Appreciate what you've helped us all gain in knowledge and your vocalization of our aligned concerns. Hope to get some additional clarity and help with reflection.

• A: We had 44 users login with their CS accounts, 16 of whom did not delete those connections. I have emailed every one of them personally. We have to do our final broker connection tests in production - these providers don’t offer the ability to test specific connections in a dev or test environment. In the future, we will hide this kind of thing behind feature flags so admins are the only ones that can see them. I wrote extensively about the security of our partners, and I’d encourage you to review that to see why I think this is the safest and best way to verify holdings and humans.

• Yes, I would knowingly enter my financial information on the site, and I have. I am a verified shareholder in several communities.

• Urvin has insurance that covers cyber risk that we are at fault for. However, we do not store any user credentials or anything of the sort. Credentials are stored by our partners, who all have bank-level security.

Q: Is the site going to be monetized in any way, like subs/ads/patreon/selling info via cookies?

• A: Yes, we aspire to be a sustainable, profitable business. Our primary goal is to charge public companies for access to their verified shareholders. This is important to public companies - they currently pay a lot of money to a monopolist (Broadridge) to get your mailing address. Urvin will charge far less, and give them a digital channel to engage with shareholders. Public companies are excited by this idea and are willing to pay for it. We will also offer certain premium and real-time data packages to users for a small monthly fee. Other than that, we have no specific plans, but we do like the idea of eventually allowing creators the ability leverage Urvin’s data and tools to engage with their followings like a substack.

Q: Why couldn't hedge funds buy MX and then steal our logins?

• A: I don’t know? They could also buy Computershare, or any one of many other companies? If they do, you will know about it before it happens and will be able to delete your data from MX.

Q: What confuses me to no end is why did Mr. Lauer decide to do this now? It is well known that nefarious actors most often rear their heads on a weekend. If Mr. Lauer is so connected with SuperStonk he would know that weeks end is not the best time to announce such a service that would ask for user credentials (irregardless of the methods used for authentication). More confusion, why on earth would Mr. Lauer not announce this a week or 2 in advance and ask Superstonk users for their input on security and other concerns? IMO the timing seems very suspicious when you line the announcement with what has transpired with GME in the past week. Very poor planning on Urvin’s part. If this is how Urvin handles things I surely do not want to trust them with any of my login info.

• A: When we announced it, we did not offer a Computershare connection, and I could not see any reason why FUD would be spread about the offering. The #1 most requested feature was the ability to connect your Computershare account - we were under the impression this was not possible. When we announced Urvin's VSCs on Reddit, many of you reached out with screenshots showing that other providers supported connecting Computershare accounts, and asked us to add this feature. We quickly found out that MX - an account aggregation service - provides this capability. And luckily, we had just finished integrating MX into the platform. We turned on Computershare, and pushed it to prod within 24 hours. As we tested it, we saw that it used a different authentication mechanism than other broker connections, one in which your user credentials can be exposed to MX (not to Urvin). Within about 12 hours, we disabled the ability to connect to Computershare given the concerns that were expressed about this mechanism. We heard the concerns about security and have spent the intervening time investigating and confirming that MX security practices are the absolute best out there. We have since re-enabled Computershare and will be quickly adding several other brokers with MX. I don’t think this is emblematic of any deeper, underlying issues, but that’s up to you to decide. Also, to clarify - we cannot see any user credentials that are typed into those fields, we do not store anything of the sort, nor would we want to.

Q: Have you consult a Cybersecurity firm? I understand where the data is kept but will your employees going to go through a Cybersecurity awareness program. 'If you can't hack the system, hack the user" You and Urvin employees can get hacked while having your favorite bevvy at a coffee shop and checking reddit via their Wifi, Bluetooth or NFC. What kind of hardening measurements are you going to take?

• A: Yes, we work with a top cybersecurity professional on everything we do, and our platform is regularly penetration tested. We’re a small, technologically sophisticated team and I’m comfortable with our team’s security awareness. And just to keep reiterating the point, all broker connections are read-only, and Urvin does not have to (or the desire to have access to) any user credentials - there is absolutely no way an intrusion or breach at Urvin can allow an attacker to gain any control over an account.

Q: What recognized cyber security and privacy frameworks are Urvin working to and have your controls been verified by an independent third party? Also, why is DLs pfp a wolf in (roaring) kitty clothing?

• A: We adhere to the OSSTMM framework, and our platform has been independently penetration tested regularly. My reddit pfp was randomly generated by Reddit one day and I kept it because it had curly hair (like I do) and a shark (which made my son very happy). Also that’s not a sheep, that’s a cat. And I don’t think it’s a wolf either, but can’t really tell.

Q: Dave, isn’t there a way to do this without providing personal information, more specifically our username and login? There are mixed opinions on this, and that I believe is the reason why. If we could eliminate the need for that kind of verification, I’m sure a lot more of us would be on board. I do understand that it’s a double edged sword, as any other type of verification could allow bots/shills to gain access easier, but you can’t really expect after all we have seen and all the corruption we’ve witnessed that we are just going to hand over the keys to this thing.

• A: I don’t see how - account aggregation is a very standard service with other apps, and it seems like the perfect mechanism here. Computershare is supportive of this approach, and our use of MX. If you have other ideas (or if anyone else does) I’m totally open to them! The most important quality is that we are able to authenticate that someone is a real person (broker KYC allows us to do this) and that they hold the shares they say they do. And just to keep reiterating the point, all broker connections are read-only, and Urvin does not have to (or the desire to have access to) any user credentials - there is absolutely no way an intrusion or breach at Urvin can allow an attacker to gain any control over an account.

Q: Can Urvin have its CTO or Head of IT Security publish a white paper on all the details of how an Urvin user’s brokerage / transfer agent login info is kept secure? Protocols? Other tactical details? This is a community that is particularly vigilant about infosec and data privacy, so more transparent infosec from the dev team and more clarity comms wise from Urvin will do a lot to earn trust. What was once a tough sell is now much tougher, if you’re going to ask for the customer’s most sensitive information, reciprocity is needed.

• A: I’ve published a full overview of who our partners are and what their security practices are. And just to keep reiterating the point, all broker connections are read-only, and Urvin does not have to (or the desire to have access to) any user credentials - there is absolutely no way an intrusion or breach at Urvin can allow an attacker to gain any control over an account.

Q: What data specifically do they want to collect and why? Do they plan to monetize the data they collect? How will the data be protected?

• A: We collect a minimal amount of data - we do not have access to your user credentials, for example. We collect balance and positions, and will eventually also collect transactions to help you track and calculate your P&L. Our only plans for data monetization involve helping the companies that you invest in understand the demographics of their investor base better, and to give them a channel to contact and engage with you. Data is protected with industry standard information security practices using the OSSTMM standard, and our system is regularly penetration tested.

Q: Until Computershare offers an API that allows revokable read only access to trusted tokens, any integration with them should be disabled. That said, Computershare responded to us when the community got together and told them that we wanted 2FA. Enabling connections to Computershare based on stores credentials was a big mistake, but it can be an opportunity for the community to approach Computershare again and let them know that read only access is a feature we would like to see.

• A: First, as I said earlier, Computershare has encouraged us to support this functionality with MX. Overall, I think that as long as we can provide transparency to users about how connections work, who has access to what, and what their security practices are, I am comfortable re-enabling the functionality and allowing users to make their own choices. I’d argue that the connection is revocable and read-only - first, all broker connections are read-only, and generally speaking our partners only use read-only connections. Second, you can revoke it by disconnecting the connection on Urvin, and even changing your password if you so choose. All of that said, I agree wholeheartedly with you that Computershare should build an OAuth-style authentication endpoint, to improve security and functionality.

Q: I wrote a browser plugin to notice when you're on the ComputerShare site and post your share count to a server but I didn't think I'd be able to convince anyone it was safe without getting into technical issues. Still... it would be safer than providing your username/password, and any other software engineer could verify the only thing happening is the post of a share count (anonymized). I think I may have even reached out to Dave at one point. It's probably a better solution. Mentioning it so I've mentioned it.

• A: Yes, I remember your reachout and appreciate the effort. As I mentioned though, while this exposes less information to third-parties, it’s far less accessible to most users. Our goal is to create a community that any shareholder can join, and that type of friction would really reduce the diversity and size of a verified shareholder community. That being said, it’s certainly an option we could consider down the road to offer to those who don’t feel comfortable with our approach.

Q: What is the purpose of this new platform? I know it's partly to count non-DRS shares and to have a community for investors but we already have Superstonk for that. Will the information you collect regarding the share count be used for anything or just for us to know?

• A: Our mission is to create an authentic community of verified shareholders - to end the influence of bots and shills, and to create a place where you know you’re interacting with actual people who hold actual shares alongside you. Share counts are simply a byproduct of what we’re building - they’re not the point.

Q: All my homies don’t fuck with Dave. My question is what is your business model. How does Urvin finance make money? Seemed like you wouldn’t even talk about DRS at one point. Now you want to know how much everyone has?!

• A: Our business model is simple - we will charge public companies for access to their verified shareholders. This is important to public companies - they currently pay a lot of money to a monopolist (Broadridge) to get your mailing address. Urvin will charge far less, and give them a digital channel to engage with shareholders. Public companies are excited by this idea and are willing to pay for it. We will also offer certain premium and real-time data packages to users for a small monthly fee. Other than verifying users are actual people and actual shareholders, we don’t care how much you hold - although it sounds like the community will care about the aggregate number of shares held in a community.

Q: If it is shown through your platform that non-DRS shares plus the DRS shares add up to more than the outstanding float, what then?

• A: Honestly that feels more like a question for the company than for us.

Q: Dave - Do you think it is a good idea for a majority of shareholders with DRS'ED shares on a book plan to give a nebulous 3rd party full unfettered access to their accounts?

• A: First of all - of course not. That’s why all access is read-only, and only with partners who have bank-level security. Second of all, given that, I’d propose that a community of verified shareholders would be a breath of fresh air, generally free of bots. That sounds like a community that is much less likely to spread FUD and disinformation, and one in which constructive conversations can happen. And finally, as mentioned before, Computershare is comfortable with the use of MX for this functionality and has encouraged us to offer it.

Q: What is unique with Urvin finance and what executive broker is used if any.

• A: We are unique in that we have taken a tried-and-true technology (broker authentication) and applied it in a novel way. We’ve combined it with a data-native social platform, to facilitate informed, data-driven conversations about stocks people own. We do not offer trading services and do not have any relationship with an executing broker.

Q: Are you using conditioner?

• A: Every other day! I don’t really shampoo. I also use curl cream to moisturize.

Q: Why would I want to use this new site when I have Reddit?

• A: We have professional-quality data for stock research, and a way to guarantee that communities are free of bots and shills. Sounds pretty nice to me!

Q: With everything that has gone on in this saga, if you were in my position - would you trust something like this?

• A: Yes, and I do trust what we’ve built. I’ve seen the effects that bots can have on driving and controlling narrative, and I think this is a unique way to counter that. I’d think this would be of interest to everyone here.

I hope all of this is helpful! Again, I'm happy to answer any questions below, and really encourage you to check out what we've built before you pass judgement!

tldr; Urvin is secure, transparent on broker connection security, Computershare agrees that MX is the right way to connect CS accounts, and a bot-free platform (with the ability to provide a verified share count) is a worthwhile thing to build.