WEBULL
Privacy & Security

Privacy & Security at Webull

Our Commitment

At Webull, protecting your personal information is central to how we operate. As a financial services platform trusted by millions of investors, we understand that your most sensitive data, from identification documents to financial account details, must be handled with the highest level of care.

That is why each year our systems undergo an independent SOC 2 audit, one of the most rigorous and widely recognized standards in the industry for data security, confidentiality, and availability. Successfully completing this review confirms that our safeguards are designed and operating effectively, and that we are meeting the expectations placed on leading financial and technology companies. You can find our SOC 2 certification here

What SOC 2 Means for You

A SOC 2 audit is essentially a comprehensive security check-up performed by independent experts. They evaluate how we store, protect, and manage Webull user data, and whether our practices align with strict criteria for:

Security

Preventing unauthorized access through encryption, firewalls, and monitoring.

Confidentiality

Ensuring sensitive data is only accessible to those with a legitimate need.

Availability

Keeping our systems resilient and reliable, with tested backups and disaster recovery.

For our Webull users, this means greater assurance that your data is protected at every stage: when it’s collected, when it’s stored, when it’s used, and even when it’s eventually deleted.

Where Your Data Lives

If you are a U.S. Webull user, your personal information is stored securely within the United States. It is not transferred overseas for storage or processing. By keeping your data in the U.S., we reduce risks related to cross-border data flows and ensure that your information remains subject to U.S. legal protections and oversight.

Data Location
How We Protect Your Information
Strict Access Control
Only authorized employees with a business need may access production systems, and those permissions are regularly reviewed.
Resiliency and Backups
Data is regularly backed up, monitored, and tested so that services remain available even in the event of an outage.
Encryption Everywhere
All sensitive data is encrypted both when stored and when transmitted.
Continuous Monitoring
Vulnerability scans, penetration tests, and system monitoring are performed regularly to detect and address threats.
Vendor Oversight
Third-party services providers with access to nonpublic information must have written agreements requiring them to maintain appropriate safeguards.
Employee Training
All employees receive annual privacy and cybersecurity training on handling and protecting customer information.
Independent Verification
Our SOC 2 auditors confirmed that our controls operated effectively throughout the audit period with no exceptions noted.
Strict Access Control
Only authorized employees with a business need may access production systems, and those permissions are regularly reviewed.
Resiliency and Backups
Data is regularly backed up, monitored, and tested so that services remain available even in the event of an outage.
Encryption Everywhere
All sensitive data is encrypted both when stored and when transmitted.
Vendor Oversight
Third-party services providers with access to nonpublic information must have written agreements requiring them to maintain appropriate safeguards.
Continuous Monitoring
Vulnerability scans, penetration tests, and system monitoring are performed regularly to detect and address threats.
Employee Training
All employees receive annual privacy and cybersecurity training on handling and protecting customer information.
Independent Verification
Our SOC 2 auditors confirmed that our controls operated effectively throughout the audit period with no exceptions noted.
Strict Access Control
Only authorized employees with a business need may access production systems, and those permissions are regularly reviewed.
Resiliency and Backups
Data is regularly backed up, monitored, and tested so that services remain available even in the event of an outage.
Encryption Everywhere
All sensitive data is encrypted both when stored and when transmitted.
Vendor Oversight
Third-party services providers with access to nonpublic information must have written agreements requiring them to maintain appropriate safeguards.
Continuous Monitoring
Vulnerability scans, penetration tests, and system monitoring are performed regularly to detect and address threats.
Employee Training
All employees receive annual privacy and cybersecurity training on handling and protecting customer information.
Independent Verification
Our SOC 2 auditors confirmed that our controls operated effectively throughout the audit period with no exceptions noted.
Privacy & Security FAQs
What is SOC 2 and why does it matter?Expand
How often do you go through SOC 2 audits?Expand
Where is my personal information stored?Expand
What counts as “personal information”?Expand
View Morearrow