Isolation you can prove, not just promise.
Commercial property data is sensitive — leases, financials, contacts. We treat leakage between customers as unacceptable and build the boundary into the database, not just the screen. This is an overview of how we protect your data.
Isolation, enforced in the database
Every organisation’s data is fenced with row-level security on every table — the same boundary whether a request comes through the app, the API or a portal. The property owner owns the record; a managing agent can be removed without data loss; occupiers and contractors only ever see their own.
Authentication & MFA
Sign-in is protected by strong password handling and optional time-based multi-factor authentication (TOTP), which is required for owner-level roles. Assurance level is enforced for sensitive access, not just in the interface.
Encryption
Traffic is encrypted in transit with TLS, and data is encrypted at rest by our infrastructure provider. Credentials are never stored in plain text.
Immutable audit trail
Consequential actions are written to an append-only audit log that cannot be altered — not even by an account owner — for legal defensibility and accountability.
Document safety
Uploaded files are scanned for malware and quarantined on a positive verdict, so an infected file can’t be served — and portal users can only reach files tied to their own records.
Least-privilege boundaries
Elevated database access is confined to a small, reviewed server-side boundary and blocked from user-facing code by an automated lint rule, so a bug can’t accidentally bypass isolation.
Hosted in the UK.
Our primary infrastructure runs in the United Kingdom (London region). Managed Postgres, authentication and file storage sit with our infrastructure provider on a paid tier with point-in-time recovery available; the application and background workers run on UK-served platforms.
Reviewed, not set-and-forget.
Schema, auth and security changes are reviewed and tested against an automated isolation suite before they ship. Continuous integration runs dependency scanning and secret scanning on every change, and we carry out regular internal security reviews of the platform.
Found a vulnerability?
We welcome responsible disclosure. If you believe you’ve found a security issue, please report it privately — don’t test against other organisations’ data or disrupt the service — and give us reasonable time to fix it before any public disclosure.
To report a security vulnerability, email security@propertyaxis360.com.
Report a security issue