we-promise · mintlify · Aug 22, 2026 · Aug 22, 2026 · Aug 22, 2026 · Aug 22, 2026
diff --git a/docs.json b/docs.json
@@ -69,13 +69,15 @@
             "pages": [
               "providers/overview",
               "providers/market-data",
+              "providers/onchain-wallets",
               "providers/binance",
               "providers/enable-banking",
               "providers/lunchflow",
               "providers/wise",
               "providers/simplefin",
               "providers/plaid",
               "providers/redbark",
+              "providers/up",
               "providers/snaptrade",
               "providers/binance",
               "providers/coinbase",

diff --git a/guides/app-features/transactions.mdx b/guides/app-features/transactions.mdx
@@ -94,6 +94,33 @@ Sure prevents merges that would make the category hierarchy confusing or invalid
 
 If a source category has subcategories and the target is a parent category, Sure reparents those subcategories under the target.
 
+## Transaction rules
+
+Rules automatically apply actions to transactions that match a set of conditions. Create and manage rules from **Settings > Rules**.
+
+### Condition types
+
+| Condition | Operators | Notes |
+|---|---|---|
+| Transaction name | Contains, Does not contain, Equals | Matches the transaction display name |
+| Amount | Greater than, Less than, Equals | Absolute value |
+| Account | Equals | Matches a specific account |
+| Category | Equal to, Is empty | Matches the assigned category |
+| Merchant | Equal to, Is empty | Matches the assigned merchant |
+| Tag | Equal to, Is empty | Matches any tag assigned to the transaction |
+
+Multiple conditions can be combined with AND or OR logic. When using multiple tag conditions with AND, each condition is evaluated independently — a transaction matches when it carries all of the specified tags.
+
+### Action types
+
+Rules can set the category, merchant, tags, notes, or investment activity label on matching transactions.
+
+### When rules run
+
+Rules run automatically during family syncs and can be triggered manually from **Settings > Rules** using **Re-apply** (single rule) or **Apply all**.
+
+Rules do not run on manual transaction creation or editing — only on syncs.
+
 ## Related pages
 
 - [Budgets](/guides/app-features/budgets)

diff --git a/providers/onchain-wallets.mdx b/providers/onchain-wallets.mdx
@@ -0,0 +1,119 @@
+---
+title: "Self-custody wallets"
+description: "Track Bitcoin, EVM, and Solana wallets natively without a third-party provider"
+---
+
+Sure can track self-custody wallets directly — no CoinStats account or other third-party service required. Link a Bitcoin, EVM-compatible (Ethereum, Base, Arbitrum, Optimism, Polygon, Gnosis), or Solana address and Sure will sync balances, token holdings, and transaction history automatically.
+
+## How it works
+
+When you link a wallet address, Sure:
+
+1. Reads the current balance and token holdings from a public blockchain explorer
+2. Creates a crypto wallet account for each asset you choose to track
+3. Imports transaction history and reconstructs cost basis where price data is available
+4. Syncs on a recurring schedule — only writing new data when something changed
+
+Balances come from an address summary endpoint, not from transaction history, so they are always current even when history is capped.
+
+## Prerequisites
+
+- A crypto market data provider must be enabled to value your holdings. Without one, quantities are tracked correctly but every wallet shows a zero balance. Go to **Settings > Self-Hosting > Market data** to enable a provider, or use the one-click button in the wallet linking UI.
+- Families whose currency is not USD also need an exchange rate provider configured. Sure's default exchange rate provider (Twelve Data) requires an API key; [Frankfurter](https://www.frankfurter.app/) is a free keyless alternative.
+
+## Linking a wallet
+
+<Steps>
+  <Step title="Open the wallet panel">
+    Go to **Settings > Bank sync** and find **Self-custody wallets** under Available connections.
+  </Step>
+  <Step title="Paste your address">
+    Enter a wallet address. Sure validates the format and detects which networks the address is active on.
+  </Step>
+  <Step title="Confirm the network">
+    If the address matches more than one network (for example, a 0x address is valid on all six EVM networks), Sure checks each one for activity and shows you the results. Select the network or networks you want to track.
+  </Step>
+  <Step title="Choose what to track">
+    Sure lists the assets found at that address. Assets that can be priced are pre-selected; spam airdrops and unrecognized tokens are listed but unchecked. Tick or untick assets, then confirm.
+  </Step>
+</Steps>
+
+Sure creates one account per asset. Previewing an address creates no connection record — an abandoned flow leaves nothing behind.
+
+<Warning>
+Never enter a seed phrase or private key. Sure only needs a public wallet address.
+</Warning>
+
+## Supported networks
+
+| Network | Type | Notes |
+|---|---|---|
+| Bitcoin | Bitcoin | Single address only (see limitations) |
+| Ethereum | EVM | Optional Etherscan key for higher rate limits |
+| Base | EVM | |
+| Arbitrum | EVM | |
+| Optimism | EVM | |
+| Polygon | EVM | |
+| Gnosis | EVM | |
+| Solana | Solana | SPL tokens named via Jupiter verified token list |
+
+## Managing a linked wallet
+
+From **Settings > Bank sync > Self-custody wallets**, each linked wallet has four actions:
+
+- **Sync** — trigger an immediate sync
+- **Review tokens** — reopen the asset selection screen to add or remove tracked tokens without changing the address
+- **Change address** — update the address while keeping all existing accounts, holdings, entries, and balance history
+- **Disconnect wallet** — remove the provider link; existing accounts become manual and stop updating
+
+To stop tracking a single asset without disconnecting the whole wallet, use the per-asset **Disconnect** button next to that token in the wallet panel.
+
+## Transaction history and cost basis
+
+Sure imports movements as signed trades (Buy / Sell) when a price is available for that date, so cost basis and the value chart reconstruct back to acquisition. When no price is available, a display-only entry is recorded with the quantity preserved — it becomes a real trade automatically once price history is backfilled.
+
+History depth is capped at 10 pages per address by default (configurable with `ONCHAIN_HISTORY_MAX_PAGES`, max 200). When an address has more history than the cap allows, the wallet panel shows an incomplete history notice. Balances are never affected by the cap.
+
+## Token limits
+
+Sure surfaces at most 200 tokens per address by default (`ONCHAIN_MAX_TOKENS_PER_ADDRESS`, max 5,000). On EVM networks, tokens are ranked by market cap so real assets are kept and airdrops fall off the end. On Solana, tokens are ordered by mint address for stability between syncs. Any asset you are already tracking continues to sync regardless of the cap.
+
+## Pricing and valuation
+
+Sure prices crypto assets by symbol using your configured market data provider. This covers major coins and tokens but not every asset:
+
+- A zero balance next to a token you know is worth something means the provider does not list that symbol — the quantity is still tracked correctly.
+- DeFi positions (staked ETH, LP tokens, lending positions, Solana stake accounts) are not visible. A wallet holding most of its value in a staking protocol will under-report its total.
+- Bridged and wrapped variants (USDC.e, WETH, USDbC) are mapped to their canonical asset so they price correctly.
+
+## Self-hosting configuration
+
+### Environment variables
+
+| Variable | Default | Description |
+|---|---|---|
+| `ONCHAIN_HISTORY_MAX_PAGES` | `10` | Maximum pages of transaction history per address per sync (capped at 200) |
+| `ONCHAIN_MAX_TOKENS_PER_ADDRESS` | `200` | Maximum tokens surfaced per address (capped at 5,000) |
+| `ONCHAIN_DETECTION_TIMEOUT` | `10` | Seconds allowed for network detection during linking |
+
+### Blockchain explorers
+
+Sure uses public blockchain explorers by default. No API keys are required for basic use.
+
+| Network | Default explorer | Key variable |
+|---|---|---|
+| Bitcoin | mempool.space | — |
+| EVM (all networks) | Blockscout (per-network instance) | — |
+| Ethereum (history only) | Etherscan | `ETHERSCAN_API_KEY` |
+| Solana | Public RPC + Jupiter token list | — |
+
+An Etherscan key is optional. It only affects transaction history rate limits on Ethereum — balances and token detection always use the keyless Blockscout indexer. Adding a key does not change what is tracked.
+
+You can point Sure at your own Blockscout or mempool.space instance by overriding the explorer URLs in your environment configuration.
+
+## Limitations
+
+- **Bitcoin: single address only.** A standard HD wallet derives thousands of addresses; tracking one address under-reports a wallet whose funds are spread across derived addresses. Extended key (xpub) support is not yet available.
+- **DeFi positions are not tracked.** Staked assets, liquidity pool positions, lending balances, and Solana stake accounts are invisible to the address-balance approach used here. Use [CoinStats](/providers/coinstats) if you need DeFi coverage.
+- **Pricing is symbol-based.** Assets whose symbol the market data provider does not recognize are tracked by quantity only and valued at zero.
+- **Non-USD families need an exchange rate provider.** The crypto price provider quotes in USD; a family in EUR or another currency also needs FX rates configured.
diff --git a/providers/overview.mdx b/providers/overview.mdx
@@ -68,6 +68,12 @@ Available providers include Yahoo Finance, Twelve Data, Tiingo, EODHD, Alpha Van
 
 ### Australian users
 
+**Up** connects your Up bank account directly using a personal API token, syncing balances and transaction history with automatic category mapping.
+
+- **Best for**: Up bank customers who want transactions pre-categorized on import
+- **Pricing**: Free (requires an Up personal API token)
+- **Documentation**: [Up](/providers/up)
+
 **Redbark** connects Australian bank accounts through the Consumer Data Right (CDR) open banking framework, with read-only consented access.
 
 - **Best for**: Users with Australian bank accounts
@@ -76,6 +82,14 @@ Available providers include Yahoo Finance, Twelve Data, Tiingo, EODHD, Alpha Van
 
 ## Cryptocurrency providers
 
+### Self-custody wallets
+
+**Self-custody wallets** lets you track Bitcoin, EVM-compatible, and Solana addresses natively — no third-party account required. Sure reads balances and transaction history directly from public blockchain explorers.
+
+- **Best for**: Users who hold crypto in their own wallets and want balances, cost basis, and transaction history without a CoinStats account
+- **Pricing**: Free (no API key required for basic use; optional Etherscan key for higher Ethereum history rate limits)
+- **Documentation**: [Self-custody wallets](/providers/onchain-wallets)
+
 ### Binance
 
 **Binance** integration connects directly to your Binance account to sync spot, margin, and earn balances along with trading history.

diff --git a/providers/up.mdx b/providers/up.mdx
@@ -0,0 +1,37 @@
+---
+title: "Up"
+description: "Sync your Up bank account transactions and balances into Sure"
+---
+
+Up is an Australian neobank. Sure connects to Up using the Up API to sync account balances and transaction history.
+
+## Setting up Up
+
+<Steps>
+  <Step title="Get an API token">
+    In the Up app, go to **Settings > API** and generate a personal access token.
+  </Step>
+  <Step title="Add the connection">
+    In Sure, go to **Settings > Bank sync**, find **Up**, and enter your API token.
+  </Step>
+</Steps>
+
+## What syncs
+
+- Account balances
+- Transaction history (name, amount, date, and category)
+
+## Automatic category mapping
+
+Up assigns a category to each transaction. Sure maps Up's category slugs to your existing Sure categories automatically during import, so transactions arrive pre-categorized without any manual work.
+
+Mappings are applied only when a matching Sure category already exists in your family. If you have not set up categories yet, transactions import uncategorized and the mapping applies once you create the relevant categories.
+
+Categories you have manually set or locked on a transaction are never overwritten by the mapping — a re-sync preserves your choice.
+
+High-confidence mappings are applied automatically. Up-specific categories with no clear Sure equivalent (such as Booze, Pets, Apps & Games, and Life Admin) are left uncategorized so you can apply your own rules or AI categorization.
+
+## Limitations
+
+- Read-only access — Sure cannot create or modify transactions in Up
+- Category mapping covers common spending categories; niche Up categories remain uncategorized
diff --git a/self-hosting.mdx b/self-hosting.mdx
@@ -481,6 +481,37 @@ For production deployments:
 - Use `SMTP_OPENSSL_VERIFY_MODE=peer`
 - If you must use self-signed certificates, provide a CA bundle via `SSL_CA_FILE`
 
+## System health
+
+Sure includes a built-in system health page for super-admins at **Settings > Advanced > System health** (or `/settings/admin/system_health`). It shows live Sidekiq state: worker process count, last heartbeat, maximum queue latency, job counters, and per-queue depth.
+
+### Sidekiq health banner
+
+When the Sidekiq worker is not processing jobs, a banner appears on every authenticated page for super-admins. The banner explains that background data may be stale and links directly to the system health page.
+
+Common reasons Sidekiq may be unhealthy:
+
+- The `worker` container is not running — check with `docker compose ps`
+- Redis is unreachable — check with `docker compose logs redis`
+- The worker process has stalled (no heartbeat in the last 2 minutes)
+- A queue has backed up beyond 5 minutes of latency
+
+The health check is cached for 60 seconds to avoid extra Redis round-trips on every page load. The system health page bypasses the cache so you always see fresh state after restarting the worker.
+
+### Tuning health check thresholds
+
+You can adjust the detection thresholds with environment variables:
+
+| Variable | Default | Description |
+|---|---|---|
+| `SIDEKIQ_HEALTH_HEARTBEAT_TIMEOUT` | `120` | Seconds before a stale heartbeat is flagged |
+| `SIDEKIQ_HEALTH_LATENCY_THRESHOLD` | `300` | Seconds of queue latency before flagging as backed up |
+| `SIDEKIQ_HEALTH_CACHE_TTL` | `60` | Seconds to cache the health snapshot |
+
+<Note>
+The health check only runs on self-hosted instances. It is skipped entirely on managed deployments.
+</Note>
+
 ## Troubleshooting
 
 ### Database connection errors