Security at PropertyFlow
Property records hold personal information about owners, tenants and their homes. We treat protecting it as part of the product, not an add-on.
Every organisation is walled off
Each agency, body corporate or owner is a separate organisation. Postgres row-level security enforces that separation inside the database, so even a mistake in application code cannot show one organisation's records to another.
The application connects with a database role that cannot bypass those rules. Only migrations run with elevated rights.
People only see what they need
Admins, agents, residents and contractors sign in to separate portals with separate accounts and sessions.
Agents see only the schemes assigned to them, residents only the homes they are linked to, and contractors only the jobs sent to them. The same rules apply to the API.
Encrypted in transit and at rest
All traffic uses HTTPS. Connections between our servers and the database are encrypted too.
The database and file storage are encrypted at rest. Email addresses, phone numbers and two-factor secrets are encrypted a second time inside the database.
Documents and photos are kept in private storage that is never publicly listed, and the links we show you expire.
Accounts and sign-in
Passwords are stored as salted bcrypt hashes, and repeated sign-in attempts are rate limited.
Two-factor authentication with an authenticator app is available to everyone and required for PropertyFlow staff. You can also sign in with Google.
Every action PropertyFlow staff take in the support console is recorded in an audit log.
Infrastructure
PropertyFlow runs on DigitalOcean in the United Kingdom, with file storage in Germany, behind Cloudflare. The database is on a private network and accepts connections from our application server only.
Firewalls allow web traffic through Cloudflare only, and server access from approved addresses only.
Databases are backed up daily and copies are kept separately from the live system.
Privacy and POPIA
You stay the responsible party for the personal information you store in PropertyFlow; we process it on your behalf and only to provide the service.
Read our privacy policy for what we collect and your rights under the Protection of Personal Information Act.
Found a security issue?
Please tell us privately and give us a reasonable time to fix it before sharing it. We will not take action against good-faith research.
See PropertyFlow with your own portfolio
We will set up a demo with a few of your estates or homes, so you can see exactly how it works for your team, residents and contractors.