Security and your data
Your association's records are kept apart from everyone else's
Each association has its own database, its own sign-in system and its own file storage. The database itself enforces who can see what.
Your own database.
Other associations' residents aren't stored in it, so no search in your system can return their records.
Access rules are enforced by the database.
Each person's access is checked on the data itself, before anything reaches the screen.
Card details never reach us.
Payments go through Stripe Checkout, and residents enter their card details on Stripe's own form.
Changes are logged.
Changes to money, settings and board access are logged with the old and new values. Only the president can view the log.
Roles
Who can see what
| Homeowner | Renter | Director or treasurer | President | |
|---|---|---|---|---|
| Who filed a complaint | Only their own | Only their own | Only if the board has chosen "every board member" | Yes |
| Supporting documents for an accommodation request | — | — | Only if the board's policy opens it to the whole board | Yes, by default |
| Board-only documents | No | No | Yes | Yes |
| A household's balance and receipts | Their own | No | Yes | Yes |
| Another household's record | No | No | Yes | Yes |
| Site settings, feature switches, audit log | No | No | No | Yes |
The site's administrator account can see everything the president can. For accommodation requests, the whole board always sees the request itself and makes the decision.
Record keeping
Corrections are added, and the original stays on file
Messages.
Messages can't be edited or deleted in the app, even by the site administrator.
Notices and collection records.
Mistakes are corrected with a new entry, and the original stays.
Tow records and photos.
New entries are added, and earlier ones are never replaced.
Gate codes and other secrets.
The audit log notes that a code changed, but never records the code itself.
Bank accounts.
Only the last four digits are ever stored.
When someone steps down or moves out
Access ends with the role.
Removing someone's board seat also ends their access to the board console.
Gate access revoked.
When a resident leaves, their gate credentials and vehicle registrations are revoked, and the board is reminded to collect any devices.
No forgotten board access.
An account can't be deactivated while it still has board console access, so that access is always removed first.
What we store, and what we don't claim
- We store residents' names, addresses, contact details, balances and correspondence, because the software can't work without them.
- Separate databases limit the harm any single mistake can cause, but they are not a security certification.
- We have not had an independent security audit. If your board requires one, please ask us before you buy.
Your records belong to you
We will export all of your data whenever you ask.