Security in plain English
You should not need a technical background to understand how we treat your information. In short: your data is for your account, your files stay private, connections and stored data are encrypted, and we do not sell your personal information.
Your account is yours
Sign in securely with email or social login. You can enable multi-factor authentication (MFA) in your account settings. Only you see your portfolio — tenants get their own link to their tenancy, not your full account.
Documents stay private
Agreements, notices, and uploads are stored privately. They are not published on the open web or shared with other landlords.
Payments handled by Stripe
Card details are processed by Stripe. TenancyIQ does not store your credit card number on our servers.
Encrypted in transit and at rest
In the browser, your data travels over a secure HTTPS connection — the padlock you expect from online banking. What we store on our systems, including documents, is kept on encrypted infrastructure.
AI assists — you decide
AI can draft or extract information to save time. Always review anything important before you send it or act on it.
Trusted partners help us run the product (sign-in, payments, address lookup, AI). Details are in our Privacy Statement.
For the nerds
Implementation notes for engineers, IT reviewers, and security researchers. This reflects controls in place today; we improve them as the platform evolves.
Encryption
- TLS (HTTPS) in transit; HSTS enforced in production
- AES-256 encryption at rest for database and object storage (infrastructure providers)
- AES-256-GCM for selected integration tokens (e.g. Akahu, MBIE OAuth)
Authentication & access
- Clerk for landlord identity; MFA when enabled on the Clerk account
- requireAuth on protected APIs; owner-scoped storage queries
- Tenant portal: time-limited links and separate session model
Documents & uploads
- Private object storage; no public buckets
- PDF magic-byte / parse validation; attachment-oriented downloads
Platform controls
- CSP, X-Frame-Options, X-Content-Type-Options, X-XSS-Protection, Referrer-Policy, HSTS
- Rate limits on auth, billing, tenant-portal, and invite flows
- Webhook signature verification (Clerk, Stripe, SendGrid, Firma, etc.)
- Audit logging; production API errors omit raw stack details to clients
Subprocessors: Clerk · Stripe · Addy · Anthropic · hosting/object-storage providers. We do not claim SOC 2 or ISO 27001.
Report a security issue
If you believe you have found a vulnerability, contact us privately before sharing it publicly so we can investigate and respond. Include the affected page or workflow, steps to reproduce, and any screenshots or logs.
[email protected]Privacy & your rights
Under the NZ Privacy Act 2020 you can request access, correction, or deletion. Contact [email protected] or see our Data Deletion page. Encryption and technical detail are summarised above; see our Privacy Statement for how we collect and use information.