Security

Property finances are sensitive. Here's how we keep your data safe.

In transit and at rest

All connections are TLS 1.2+. Database storage and backups are encrypted at rest using the provider's managed keys. Session cookies use HTTP-only and Secure flags.

Authentication

Passwords are hashed with bcrypt. Magic-link email sign-in is supported. Passkeys are on the roadmap. Session tokens refresh automatically and are revoked on sign-out.

Authorization

Access controls are enforced at the database layer: a query for another user's data returns zero rows even if the application layer has a bug. Admin actions require an app_role = 'admin' profile and are logged.

Investor share pages

Each share link is a 22-character random token. Tokens are the auth factor, so anyone with the URL can read the report. You can revoke a token (the page shows a friendly "no longer available" screen) or require a password.

Backups and recovery

Point-in-time recovery is available for the last 7 days. A full daily snapshot is retained for 30 days. We test restore procedures quarterly.

Vulnerability disclosure

Report security issues to [email protected]. We acknowledge within 48 hours and don't pursue action against good-faith researchers.