Built so everyone sees their part, and only their part.
Property records include some of the most personal information people share: where they live, what they pay, what's wrong with their home. Here's how we protect it.
Access control in the database
Every table has row-level security policies that decide which rows each person can read or change, based on their role: owner, delegate, manager, staff, contractor, accountant, tenant or family viewer. A mistake in a screen can't expose another tenant's file, because the database itself refuses.
- Tenants never see quotes, owner financials or other tenants
- Mortgages are visible to owners only
- Contractors see only cases assigned to them
- Accountants are read-only
- Family viewers need the leaseholder's consent
Records that can't be quietly changed
Payments and expenses can't be deleted by anyone, only voided with a reason. Changes to money, leases, permissions and documents are written to an audit log with who, what and when.
- Void-only financial records, enforced by database triggers
- Audit log of sensitive changes
- Owner spending limits enforced in the database
Tested for every role
Our automated test suite applies the full database schema to a real Postgres engine and checks what each role can and can't do: over a hundred access checks run before every release.
Private files
Repair photos, bills and documents are stored in a private bucket. They're shown through short-lived signed links, never public URLs.
Accounts linked by verified email
When you're invited as an owner, accountant, staff member or tenant, your account is linked to those records only after you've verified that email address.
Encryption
Data is encrypted in transit with TLS and at rest by our infrastructure providers.
On the roadmap
- Two-factor authentication for owners, managers and staffComing soon
- Encrypted, reveal-logged fields for lockbox codes and banking detailsComing soon
- SAML single sign-on for EnterpriseComing soon
- Independent penetration test and published summaryComing soon
- Canadian data residency optionComing soon
Report a vulnerability
If you believe you've found a security issue, email security@propvara.com with the details and steps to reproduce. Please don't access other people's data, disrupt the service or publicly disclose the issue before we've had a chance to fix it. We'll acknowledge your report within three business days.
See also our Privacy Policy and Data Processing Addendum.
See your portfolio reconciled.
Try every feature free for 14 days. Founding members keep 30% off for as long as they stay.