Security & Trust
Your tenants trust you with their money and their Social Security numbers. This page says exactly how that data is handled, who else touches it, and which controls we have not built yet.
Last updated
How your data is protected
All traffic to RentFlow360 is served over HTTPS.
The most sensitive fields we hold — Social Security numbers, and bank routing and account numbers for owners, collection accounts, and utility payees — are encrypted at the field level with AES-256-GCM before they are written, using keys held outside the database and outside the codebase.
Full card numbers never reach our servers. Card and bank credentials are collected by Stripe and Plaid directly; we hold tokens, not instruments.
Who can see what
Every account holds exactly one role. Every membership write goes through a single enforcement path rather than being left to each caller, and every API route gates on that role before it touches data.
Data is partitioned by organization. A request can only read or write within the organization on the caller's own session — the organization is never taken from the request itself — and an automated guard suite scans every route on every CI run to keep it that way.
- Role-based permissions across six distinct roles
- Two-factor authentication (TOTP) available on every account
- Single sign-on (OIDC) on the Enterprise plan
- Server-side session revocation — signing out invalidates every session, with a 15-minute ceiling on access tokens already issued
- Login rate limiting and account lockout after repeated failures
Auditability
Changes to the records that matter — leases, properties, journal entries, listings, approvals, and signing envelopes — are recorded with who made them and when. Audit history is visible in the app and can be exported.
Signed documents carry their own tamper-evident audit trail, exportable alongside the document itself.
Your data stays yours
You can export your records — ledger, leases, tenant data — at any time, in formats you can take elsewhere. There is no lock-in and no export fee.
We do not sell or share personal information as those terms are defined by the CCPA/CPRA, we use no advertising trackers, and we honour the Global Privacy Control signal when a browser sends one. Account holders can submit deletion requests from within the app; anyone else can email us.
Monitoring
Application errors are captured centrally with personal data redacted before it leaves the process, so failures are noticed and diagnosed without exporting customer records into a monitoring tool.
Subprocessors
These are the third parties that process customer data on our behalf, and what each one receives. Several are engaged only when you use the feature they serve — no screening report is ordered unless you order one, and no SMS is sent unless SMS notifications are on.
| Provider | Purpose | What they receive |
|---|---|---|
| Stripe | Payment processing and subscription billing | Card and bank details, payment amounts, billing contact |
| Plaid | Bank account verification and balance checks | Bank login is performed on Plaid; we receive tokens and account metadata |
| UtilityAPI | Connecting a utility account so bills and usage import automatically, when you connect one | The utility account you authorise, and the billing and usage history it returns |
| Green Button data custodians | The same utility import, for utilities that publish their own Green Button endpoint instead | The utility account you authorise, and the billing and usage history it returns |
| Checkr | Background and credit screening, when you order it | Applicant identity details required to run the report |
| Onfido | Identity verification, where enabled | Identity document images and verification results |
| Experian (RentBureau) | Reporting rent payments to the credit bureau — only where the organization has enabled it and the tenant has opted in | Tenant name and email, the rental address, and the amount, due date, payment date and lateness of each reported payment |
| Resend | Transactional email | Recipient address and message contents |
| Postmark | Transactional email (secondary route) | Recipient address and message contents |
| Twilio | SMS notifications, where enabled | Recipient phone number and message contents |
| Amazon Web Services (S3) | Encrypted offsite backups of the platform database | A complete copy of the records the platform holds, encrypted before upload |
| Amazon Textract | Reading figures off an uploaded document — pay stubs and proof of income — where applicant verification is enabled | The document being verified, in full |
| Anthropic | AI extraction and drafting for the features that use it: utility-bill parsing and listing descriptions | The text of the bill you upload, or the file itself where text cannot be extracted; listing and property details |
| Cloudinary | Image hosting and delivery | Listing and property images |
| OpenStreetMap (Nominatim) | Turning an address into map coordinates | The address or search text being looked up — no account or person attached to it |
| Sentry | Error monitoring | Stack traces and request context, with personal data redacted before send |
| Vercel | Application hosting and privacy-friendly web analytics | Request metadata; analytics is cookieless and not tied to an identity |
What we do not claim
This section exists because the ones above are worth more if you can trust them. Rather than let a reviewer discover these during diligence, here they are:
- RentFlow360 is not SOC 2 certified. We have not been through the audit, so we do not claim the report or use the badge.
- We have not commissioned a third-party penetration test. Security work here has been internal review and automated checks, and we would rather say that than let the word "tested" do work it has not earned.
- We describe field-level encryption of specific sensitive columns because that is what we do. We do not claim blanket encryption at rest for the whole database; that is a hosting-layer control we are working through with our provider.
- Self-serve plans carry no contractual uptime SLA or service credits. If you need one in writing, it is available on a negotiated agreement — talk to us.
- We do not currently offer customer-managed encryption keys, data residency selection, or on-premise deployment.
Reporting a vulnerability
If you believe you have found a security issue, email support@rentflow360.com with "SECURITY" in the subject line and enough detail to reproduce it. We aim to acknowledge within two business days and to keep you updated until it is resolved.
Please give us a reasonable window to fix an issue before disclosing it publicly, and do not access, alter, or retain data that is not yours while investigating. We will not pursue legal action over good-faith research that follows those two rules.