Security you can
actually trust.
Tenant data is sensitive. We treat it that way. Organization-scoped isolation, an immutable audit trail, encrypted Social Security numbers, and private document storage — built in from day one.
How we protect your data
Org-Scoped Isolation
Every tenant-scoped record carries the organization it belongs to. On authenticated requests that value comes from the session, never from the request — so changing a request cannot widen what it returns.
- Organization scope on authenticated requests is resolved from the session, never client-supplied
- Per-resource permission checks on authenticated API calls
- Core records are soft-deleted, so an audit trail is never left orphaned
- Tenant and owner portal access can be revoked instantly
Role-Based Access Control
Access is gated by role on every operation. Tenants see only their own tenancy, owners only their own portfolio, and staff only what an admin has granted them.
- Roles: Super Admin, Org Admin, Manager, Staff, Tenant, Vendor and Owner — plus a non-human AI Assistant service account
- A per-staff page-permission layer on top of roles
- A separate commercial entitlement layer — a subscription never grants a permission
- Acting on your behalf, the AI is bounded by your role and gets no extra reach; running on its own it is a restricted service account with no finance writes, no TIN reveal and no audit access
Audit Logging
Record changes are logged with a timestamp, actor, and before/after snapshot — including everything the AI does on its own. Audit rows survive the deletion of the user who caused them.
- Before/after snapshots on record changes, retained even after a user is deleted
- Autonomous AI actions recorded distinctly, with the reason they were permitted
- Who approved which AI draft, and when
- Exportable for compliance review
Authentication
Authentication is handled by Clerk — a dedicated auth platform with session management and organization-level controls.
- Multi-factor authentication available via Clerk
- Organization-level role assignment
- Access revocation takes effect on the next request
- Webhook-verified user sync
Infrastructure
The web application runs on Vercel with a managed Neon Postgres database, alongside an isolated AI operations service on Railway. Encryption in transit and at rest is provided by those platforms.
- Encryption in transit and at rest via Vercel and Neon
- Serverless web tier; the AI operations service runs as an isolated container
- Environment variable isolation per deployment
- Third-party credentials encrypted before they reach the database
Social Security & Tax ID Numbers
A Social Security or tax ID number is treated as its own class of data, not as another field on a form. It is encrypted before it reaches the database, it is never shown in full by default, and every attempt to see one is recorded.
- Encrypted with AES-256-GCM before storage — the raw number is never written in readable form
- Only the last four digits are shown by default
- Revealing a full number requires an organization admin; managers and staff cannot
- Every reveal is written to the audit log, naming who looked and when
Document Security
Government IDs, proof of income, signed leases and inspection photos are never publicly addressable. Every file is fetched through a permission check, over a link generated for that request alone.
- No document has a public or permanent URL — every fetch goes through an access check
- Access links are generated per request and are short-lived — five minutes for normal viewing and downloads
- Most uploads go straight from the browser to storage; imports, vendor-portal photos and documents we generate are handled by our servers and stored the same way
- Inspection photos are flagged sensitive and cannot be promoted into a public listing
Data Handling & Retention
Personal data does not sit around indefinitely. A scheduled sweep enforces per-data-class retention windows, and inbound webhooks for auth, payments, screening and e-signature are signature-verified and fail closed.
- Automated daily PII retention sweeps with configurable windows
- Screening reports are stored with taxpayer IDs and card numbers masked out
- Raw screening reports minimized after a short window — only the recommendation is kept
- Webhook signature verification that fails closed (auth, payments, screening, e-sign)
- A tenant can remove any document they uploaded — its extracted text and search-index entries are destroyed with it
- Organization admins can export a portable snapshot of their data
Have specific security requirements?
We're happy to walk through our security posture, our data handling, or answer detailed compliance questions.