Security & Data Handling

• Passwords must be at least 8 characters, cannot be a password from our list of commonly-breached passwords, and must mix at least two character types (upper/lowercase, digits, symbols) so repetitive strings like "aaaaaaaa" are rejected — enforced on every signup, password change, and reset, for both staff and tenant-portal accounts.
• Passwords are hashed with bcrypt before storage. We never store or log plaintext passwords.
• Optional two-factor authentication (TOTP) works with any standard authenticator app (Google Authenticator, Authy, 1Password, etc.), set up via QR code.
• Enabling 2FA generates 10 single-use backup codes, shown to you once. Each is stored only as a bcrypt hash, the same as your password.
• Disabling 2FA or regenerating backup codes requires re-entering your password.
• If you lose access to your authenticator app and your backup codes, an administrator can reset 2FA on your account as a last-resort recovery step — every such reset is logged.

• All traffic to the app and API is served over HTTPS/TLS — our hosting providers (Vercel for the app, Render for the API) terminate TLS on every request and automatically redirect any plain HTTP request to HTTPS.
• The app sends security headers on every response: X-Frame-Options (blocks the site from being embedded in another page — anti-clickjacking), X-Content-Type-Options, a strict Referrer-Policy, and a Permissions-Policy that disables camera/microphone/location access by default.
• Our database runs on Neon's managed PostgreSQL, whose infrastructure encrypts stored data at rest.

• Subscription payments and rent payments are processed by Stripe Checkout and the Stripe Billing Portal. Card numbers are entered directly into Stripe's hosted forms — they are never sent to or stored on PropAgent's servers.
• We store only what Stripe reports back to us about your subscription: plan, status, and billing metadata — never a raw card number.
• Payment webhook events from Stripe are verified by signature before we act on them.

• PropAgent is multi-tenant: every property, unit, tenant, lease, maintenance ticket, document, and financial record belongs to one organization.
• Every query for that data is scoped to the requesting user's organization at the database level — one customer's account has no path to another customer's data.
• External integrations (Zapier, Make, custom scripts) authenticate with a per-organization API key, scoped the same way as a logged-in user.

• Frontend: hosted on Vercel.
• API/backend: hosted on Render.
• Database: managed PostgreSQL on Neon.
• We rely on established infrastructure providers rather than self-managing servers, so patching, network security, and physical security of the underlying hardware are handled by those providers.

• Login, signup, password-reset, and 2FA endpoints are rate-limited per IP address (typically 5–10 attempts per minute) to slow down credential-stuffing and brute-force attempts.
• The tenant portal's login and password-reset endpoints are rate-limited the same way.
• Rate limiting keys off the real client IP as reported by our hosting provider's edge network, not a value a client can spoof.

Responsible Disclosure

If you believe you've found a security vulnerability in PropAgent, please email us at propagentapp@gmail.com with details and steps to reproduce. We ask that you give us a reasonable window to investigate and fix an issue before disclosing it publicly, and that you avoid accessing or modifying data that isn't your own while testing. You can also reach us through our contact page.