Legal

Security.

How Urvo protects account and trip data, and how to report a vulnerability if you find one.

Effective 10 August 2026

Our approach

A ride-hailing marketplace holds information people care about: where they went, what they paid, and documents proving who they are. We treat that as the reason security has to be part of how the product is built rather than something added afterwards.

This page describes the practices we hold ourselves to. It is not a certification claim, and we will say so plainly here if and when we obtain a formal audit.

How we protect data

Encryption in transitTraffic between the apps, this site and our services is encrypted using current TLS.

Encryption at restStored data, including backups, is encrypted on disk.

Least privilegeAccess to production systems and personal data is limited to the people whose role requires it, and is reviewed.

Payment isolationCard details are handled by our payment providers. Urvo does not store full card numbers.

Document handlingDriver identity and vehicle documents are stored for eligibility checks and are not shared with riders.

Logging and reviewAccess to sensitive systems is logged so unusual activity can be investigated.

What we will never ask you for

Urvo will never ask for your password, a one-time verification code, or full card or bank details — not by phone, email, message or in person. Anyone asking for those is not Urvo, however convincing they sound.

If someone contacts you claiming to be Urvo and asks for any of the above, end the conversation and report it to us.

Keeping your account safe

Protect your codeKeep one-time codes to yourself, including from anyone claiming to be support.

Check the tripMatch the driver, vehicle and plate against the app before getting in.

Use official channelsDownload Urvo only from the official app stores, and use links published on this site.

Tell us earlyIf your account or phone number may have been compromised, contact us straight away.

Reporting a vulnerability

If you believe you have found a security vulnerability in Urvo, we want to hear about it. Report it privately through the Security reports channel on our contact page, with enough detail to reproduce the issue — the affected endpoint or screen, the steps you took, and what you observed.

Please give us a reasonable opportunity to investigate and fix the issue before disclosing it publicly. We will acknowledge your report, keep you updated while we work on it, and confirm when it is resolved.

Testing responsibly

If you are researching in good faith and follow the guidance below, we will not pursue action against you for your research.

Stay within your own dataDo not access, modify or delete data belonging to anyone else. Use your own test accounts.

Do not degrade the serviceNo denial-of-service testing, spam, or anything that disrupts real riders and drivers.

No social engineeringDo not target Urvo staff, drivers, riders, or our providers.

Stop and reportIf you encounter personal data, stop, do not retain a copy, and tell us in your report.