Security built into every request
Two-step sign-in, authorization checked on the server for every request, an audit log that only grows, and no card or bank numbers stored.
How your data is protected
Two-step sign-in
Staff and owner accounts must verify a second factor to sign in.
Sessions you can see
Each person sees their own sessions and can end any of them. Idle and absolute timeouts apply.
Authorization on every request
The server checks role and record ownership on every request. There is no query without a scope. A resident sees their lease; an owner sees their properties; staff see the property groups they are assigned.
An audit log that only grows
Every state change records who, what, when, from where, and the values before and after, in the same transaction. Rows are never edited or deleted.
No card or bank numbers
Full card and bank numbers are never stored.
No Social Security numbers
Social Security numbers are never stored in the product.
Two-person rules on money
Period reopen, owner distributions and payout-detail changes wait for a second person. The person who made the change cannot confirm it.
Uploads scanned
Every uploaded file goes to quarantine and is scanned before anyone can open it.
Keys and codes encrypted
Keys and access codes are encrypted at rest, shown masked, and revealed one at a time with an audit row.
Your data, exportable
An administrator exports everything the company owns as CSV files. Sign-in secrets, sessions and processor tokens are left out.
Security reviews
Send us your security questionnaire and we will answer every question in writing.
We are glad to walk your team through how access, data and payments are handled.
Reporting a problem
If you find a security problem, write to the address in the footer with enough detail to reproduce it. Please do not test against accounts or data that are not yours.