Information Security Policy

The business operator owns information security and is responsible for maintaining this policy, applying the controls below, reviewing risks, and responding to incidents. This policy is reviewed at least annually and when significant changes occur, and is updated as the program matures.

• User passwords are never stored in plaintext — they are hashed with bcrypt.
• Multi-factor authentication (TOTP) is available on landlord accounts, with one-time recovery codes.
• Sessions use signed, HTTP-only cookies with expiration; landlord and tenant sessions are isolated.
• Administrative access to hosting and source control is limited to the operator and protected by MFA.
• Access follows least-privilege principles; credentials are not shared.

• All network traffic is encrypted in transit using TLS/HTTPS.
• Third-party credentials and access tokens (including bank-connection tokens) are encrypted at rest using AES-256-GCM.
• Sensitive payment data is handled by our payment processor (Stripe) and is not stored on our servers.
• Data is retained and disposed of according to our Data Retention & Disposal Policy.

Application secrets and API keys are stored as environment configuration in the hosting platform, not in source code, and are marked as encrypted secrets. Encryption keys are managed separately from the data they protect.

• Changes are version-controlled in a private repository with a reviewable history.
• Type-checking, build verification, and automated tests are run before changes are deployed.
• Security-relevant features (for example authentication and financial logic) are tested before release.
• Dependencies are sourced from reputable packages and updated as needed.

The application and its managed PostgreSQL database run on a reputable cloud platform (DigitalOcean) that provides network isolation, encrypted connections, and automated backups. Database access requires credentialed, encrypted connections and is not publicly exposed for interactive login.

We rely on established service providers — Stripe (payments), our cloud host, and email delivery — each with their own security and compliance programs. We share only the data necessary for each provider to perform its function, under their terms.

Application and platform logs are used to monitor availability, detect errors, and investigate suspicious activity. Authentication events and administrative actions can be reviewed as part of monitoring.

We periodically review the systems that store or process sensitive data, the access to them, and the third parties involved, in order to identify risks and apply mitigations (such as adding MFA, tightening access, or updating dependencies). Findings feed back into this policy and the controls above.

If a security incident is identified, we act to contain it, assess the scope and any affected data, remediate the root cause, and notify affected parties and authorities where required by law. Compromised credentials or keys are rotated, and connected-account tokens can be revoked.

This Information Security Policy is reviewed at least annually and updated as the security program matures. The “Effective” date above reflects the most recent review.

Security questions or reports can be sent to [email protected].