Security & Data Privacy
Transparent explanation of data isolation, encryption, and authorization controls.
Owner Multi-Tenant Data Isolation
Every query and data access route is strictly scoped to the authenticated user's ID. Owner A can never view, edit, or access Owner B's properties, rooms, renters, payment proofs, expenses, or reports.
AES-256-GCM Authenticated Encryption
Sensitive identity information (such as Aadhaar or ID proof numbers) is encrypted at rest using AES-256-GCM authenticated encryption before saving to the database. Encryption keys are never returned by APIs or stored in plaintext.
Private Storage & Stream Authorization
Payment screenshots and expense receipts are stored outside the public web root in private storage disks. Raw file paths are never exposed, and files can only be accessed through authorized controller policy gates.
Audit Logging & Session Controls
Security-sensitive operationsโsuch as payment approvals, password updates, session invalidation, and backupsโare logged in an immutable audit log trail.