Trust · Security
Trust center
Last reviewed 2026-07-07.
Security practices
These are the controls we run today. Nothing here is aspirational - each claim maps to behavior implemented in the product.
Tenant isolation
Every organization's data is isolated at the database engine using PostgreSQL row-level security (RLS). The organization identifier is enforced on every read and write, and the policies are set to FORCE so they apply even to the table owner. A query that forgets the organization scope returns nothing rather than leaking across tenants. Uploaded files are namespaced by organization ID in object storage and authorized on every request.
Encryption
All traffic to the application is served over TLS. The database and object storage are encrypted at rest by our infrastructure providers. Passwords are never stored in plain text - we keep only a bcrypt hash with a high work factor and cannot recover the original.
Abuse and access controls
Layered application controls deter abuse and constrain what each member can do.
- Role-based permissions (owner, admin, editor, viewer) enforced at a single gate on every mutation.
- Rate limiting on authentication, signup, invite acceptance, uploads, and exports to deter abuse.
- Same-origin request checks and modern HTTP security headers.
- Magic-byte file-type sniffing on uploads - the browser's claimed content type is not trusted.
- Optional two-factor authentication (TOTP) with recovery codes, and organization-wide session revocation.
Backups and recovery
The database is backed up automatically every night to encrypted object storage, with a documented restore procedure that is drilled against a throwaway instance. Backups are retained on a rolling window as part of normal disaster-recovery rotation. Our recovery objectives are published below.
Auditability
Sensitive changes - to bills, assessments, protests, and comparables - are written to an append-only audit log with a before/after diff, exportable as CSV or JSON Lines for your own records. Platform-operator actions are recorded in a separate cross-tenant trail, and any administrative access to a customer organization is logged and surfaced in-app while it is active.
Reporting a vulnerability
No system is perfectly secure. If you discover a vulnerability, email security@miskari.com with details so we can investigate. If we become aware of a personal data breach likely to affect you, we will notify you and the relevant authorities without undue delay, as described in our Privacy Policy.
Recovery objectives
Our disaster-recovery commitments, drilled against a throwaway restore instance on a regular schedule.
| Objective | Commitment | How |
|---|---|---|
| RPO (max data loss on failure) | 24 hours | Nightly pg_dump to encrypted object storage at 03:00 UTC. |
| RTO (time to restore service) | 2 hours | Pull last good commit, rebuild, and restore from the most recent backup. |
Role permissions
Access is governed by four organization roles on a strict ladder. This matrix is generated directly from the permission model the application enforces, so it cannot drift from reality.
| Capability | Owner | Admin | Editor | Viewer |
|---|---|---|---|---|
| View organization dataRead properties, leases, bills, protests, reports, and other records. | Yes | Yes | Yes | Yes |
| Create and edit recordsAdd or change properties, leases, bills, work orders, protests, and comparables. | Yes | Yes | Yes | No |
| Manage members and settingsInvite or remove members, change roles, and edit organization settings. | Yes | Yes | No | No |
| Own the organizationTransfer ownership and delete the organization. | Yes | No | No | No |
- Roles are a strict ladder: every higher role inherits every lower role's capabilities.
- Platform super-admins are outside this per-organization matrix. Super-admin is granted only via a command-line script (no UI) and every super-admin action is written to a separate cross-tenant audit log.
- When a platform operator impersonates an organization for support, access is read-only by default, time-bound, HMAC-bound to the operator's identity, surfaced by an in-app banner while active, and recorded with an audit prefix.
- Tenant-portal and public share links are unauthenticated bearer surfaces: anyone holding the tokenized URL has the scoped, read-mostly access it grants, independent of these org roles. Tokens are stored hashed and can be revoked.
Compliance roadmap
We publish honest statuses, including what we have notyet achieved. We will never mark something “available” that we cannot actually hand you.
- Data Processing Agreement (GDPR Art. 28)Available now
Standard DPA with Standard Contractual Clauses is published and can be countersigned on request.
- GDPR / CCPA data-subject rightsAvailable now
Access, correction, deletion, and export requests are honored per the Privacy Policy.
- Independent penetration testIn progress
Scoping an annual third-party test; a summary letter will be added to the evidence library when complete.
- SOC 2 Type IINot yet started
Not yet certified. We are building the control evidence base (this trust center is part of it) ahead of engaging an auditor.
- ISO/IEC 27001Not yet started
Not yet certified. On the roadmap after SOC 2.
Subprocessors
To run the service we rely on a small set of vendors. Each processes a defined slice of data on our behalf under a data processing agreement. This is the canonical registry - the Privacy Policy and DPA render the same list.
| Subprocessor | Purpose | Location |
|---|---|---|
| Stripe, Inc. | Payment processing, subscription billing, and rent-payment facilitation (Stripe Connect). Card numbers are stored by Stripe; we never store them. | United States |
| Neon (Databricks) | Managed PostgreSQL hosting for the primary application database. Data at rest is encrypted. | United States |
| Cloudflare, Inc. | Object storage (R2) for uploaded documents, and CDN / edge delivery. | Global edge network |
| Vercel, Inc. | Application hosting (compute) for the web app and serverless functions. | United States |
| Anthropic, PBC | AI processing for assessment extraction, protest narrative drafts, and lease summaries. Does not train on API inputs. | United States |
| Plaid Inc. | Read-only bank-transaction retrieval for reconciliation, where you connect an account. | United States |
| Functional Software, Inc. (Sentry) | Error and performance monitoring. Captures stack traces and request metadata when errors occur. | United States |
| Resend, Inc. | Transactional email (account notifications, billing receipts, alerts). | United States |
Security questionnaire
The standard vendor-security questions, pre-answered. Filter by domain or answer, and download the full set to attach to your review. Items we cannot yet truthfully claim are marked Pending rather than overclaimed.
34 of 34 questions
Something not covered here?
For a specific document (DPA, evidence request) or a question this page does not answer, email security@miskari.com. You can also review our security summary and Privacy Policy.