Security
What we actually do with your data.
Specifics you can hold us to, rather than adjectives. If something here stops being true, it should stop being on this page.
How the platform is built
Four areas matter most for a system that moves rent, stores tenant records, and opens gates. Here is how each one works.
Payment data never reaches our servers
- Card details go from the renter's browser to Stripe directly. Our servers do not receive, store, or log a card number, expiry, or CVC — there is no code path that could, because the card form is Stripe's, not ours.
- Charges run against your own connected Stripe account. Money settles to you; we do not sit in the middle holding a balance.
- We keep Stripe's identifiers for a payment so it can be reconciled against a rental, and nothing more.
Passwords and sessions
- Passwords are hashed with bcrypt at cost factor 12. They are never stored in a form we could reverse, which means we cannot tell you your password — only help you set a new one.
- Sessions are JSON Web Tokens carried in an HTTP-only cookie. Page JavaScript cannot read it, so a cross-site scripting bug elsewhere on the page cannot lift your session.
- That cookie is flagged Secure, so browsers refuse to send it over a plain HTTP connection.
Access is scoped on the server
- Roles are enforced on the server for every request, not hidden in the interface. Hiding a button is not access control; a user who guesses the URL still gets refused.
- Facility settings are restricted to system administrators and administrators of the same company. Being signed in is not sufficient.
- Machine-to-machine endpoints authenticate with an API key compared in constant time, so a caller cannot learn the key one character at a time by measuring how long a rejection takes.
Inbound webhooks are verified before we act on them
- Stripe and DocuSign both call us when something happens — a payment clears, a lease is signed. Both callbacks are signature-checked against the raw request body before anything is parsed or written.
- DocuSign Connect events are verified with HMAC-SHA256 and a constant-time comparison. An unsigned or mis-signed request is rejected, not logged and processed anyway.
- The same applies to lease-signing links, which carry a token compared the same way.
Reporting a vulnerability
If you have found something, we want to hear about it before your tenants do. Write to us and you will get a human, not a ticket number.
[email protected]- Tell us what you found, where, and the steps to reproduce it. A short proof of concept helps more than a scanner report.
- Please give us a reasonable window to fix the issue before publishing it.
- Do not access, modify, or delete data belonging to anyone else while testing. Use your own account and your own facility.
We will not pursue legal action over good-faith research that follows the guidance above. We do not currently run a paid bounty programme, so we cannot offer a reward — we would rather say so plainly than imply one.