LEGAL

Security

Updated October 5, 2026

Rentametrix holds lease, rent and resident data for student-housing operators. This page says what we do to protect it, in plain terms, and what we are still working on. Questions and vulnerability reports go to support@rentametrix.com.

Access is scoped by account and property

Accounts are invite-only. There is no self sign-up.
Sign-in runs through Auth0, with Google, Microsoft or email and password. Multi-factor authentication is available in the sign-in provider and we recommend turning it on.
Every request is checked against the caller's account and property grants on the server. A person sees only the properties an account administrator granted them, with the role set for each.
Rentametrix staff roles, data reviewer and resident read access are granted only on request, with a written reason, and every grant and revocation is recorded.
Revoking a membership, a grant or a key takes effect at the next request or within one token lifetime, at most an hour. A revoked key fails on its next call with no grace period.

AI keys are read-only

An AI key, used by MCP clients such as Claude, ChatGPT or Cursor, reaches only the tools and properties in its grants. Tools outside the grant are absent from discovery, not merely denied.
No key can write, configure or administer anything. The AI surface reads and exports only.
Each call is logged with the key id, the tool and its side-effect class. Keys are rate-limited per minute and per day.
A key is shown once at minting and can be revoked at any time by Rentametrix staff.

Resident data is hidden by default

Resident names, emails and phone numbers are masked before any screen, export, report or AI model sees them. Lease records are identified by unit, bed and lease id. A named user can be granted resident read access only by Rentametrix staff, with a reason, and partner keys can never carry it. One global switch can force masking for every caller at once.

Encryption and secrets

All traffic uses TLS 1.2 or higher. There is no plain HTTP fallback, including for integrations.
Data at rest is encrypted by Azure-managed encryption on the databases and storage we use.
Secrets live in Azure Key Vault and are injected at runtime. No credentials are committed to source control; a secret scanner runs on every commit and on the full repository history.
Integration credentials you give us, such as a property management system API key, are stored in Key Vault and used only for your account's sync.

Integrations

Property management systems are read through their official APIs. We do not scrape or drive a browser against your PMS.
Inbound webhooks authenticate on a pre-shared secret and fail closed when none is configured.
PMS data is kept in its own database and schema, separate from application data, and is never pooled across customers.
AI model providers are used under terms that do not allow training on customer data.

Logging and monitoring

Application logs, error reports and request traces are collected centrally with log retention of one year for audit records. Resident fields are redacted in logs. Alerts go to the engineering team.

Change control

Every change ships through a pull request with automated build, tests and dependency scanning before it merges. Deployments are versioned and tagged so any release can be rolled back. Dependencies are monitored for known vulnerabilities and updated on a schedule.

Backups and recovery

Databases run on managed Azure services with automated backups. Our continuity plan sets recovery time and recovery point objectives and is reviewed as part of our SOC 2 work below.

Incidents

If we confirm a security incident that affects your data, we notify your account administrators within 24 hours of confirming it and keep them informed until it is closed. To report a vulnerability, email support@rentametrix.com. We acknowledge reports within two business days and do not take legal action against good-faith research that stays out of production data.

Where we are headed

We are building toward a SOC 2 Type I report. Our policy set, control mapping and gap list exist today, and an independent penetration test is being scoped. Enforcing multi-factor authentication for all privileged access and a full restore drill are on that list. We update this page as each lands.

Subprocessors

Microsoft Azure (hosting and databases), Vercel (web hosting), Auth0 by Okta (sign-in), Anthropic and OpenAI (AI models), Resend (email), Sentry (error monitoring) and Stripe (billing). The full list and what each receives is in the privacy policy.