Customer and applicant data sit at the center of every leasing workflow. Here is how we protect it, who we share it with, and how we hold ourselves accountable.
We're matter-of-fact about what's verified, what's aligned, and what's delivered through licensed partners. No overclaiming.
Google's Cloud Application Security Assessment, completed for our Gmail integration scope. Full attestation letter available on request under NDA.
GDPR and CCPA-aligned subject access, deletion, and data portability rights. Full details in our Privacy Policy.
Credit and background reports run through licensed screening partners (Tenant Alert, Weimark) per FCRA requirements. Adverse-action workflows are built into the application flow.
Every byte of customer data is protected in motion and at rest, with key material kept out of source control.
TLS 1.2 or higher on every customer-facing endpoint. HSTS enforced. Certificates auto-rotated by Caddy. Insecure protocols disabled at the edge.
AES-256 encryption for the primary database, all backups, and uploaded documents. Encryption keys are managed separately from the application.
Rails encrypted credentials, environment-scoped vaults, and least-privilege access. Master keys never touch source control or developer laptops.
Payments are tokenized end-to-end through Stripe (PCI DSS Level 1). Raw card numbers, CVVs, and bank credentials never touch SeeClickRent servers.
We collect what we need to deliver leasing workflows—nothing more—and you stay in control of exports and deletion.
Each data category has a defined purpose and retention window documented in our Privacy Policy. Inactive deals archive automatically after two weeks.
IDs, pay stubs, bank statements, and credit reports are scoped to the originating applicant and the assigned leasing team. Retained only while the application is active, plus the FCRA-required window.
CSV exports for leads, tour feedback, and applications are built in. Full export and deletion on request—your data is yours, on the way in and the way out.
Primary infrastructure is hosted in the United States. Subprocessors handling customer data operate from US regions where available.
Every privileged action—impersonation, admin overrides, exports—is logged with user, timestamp, and context. Activity timelines on each deal and customer keep the record visible.
We do not sell customer or applicant data. Data sharing is limited to the named subprocessors below, all of which are contractually bound by data processing agreements.
Security is part of how we ship, not a quarterly project. Every change goes through a defined path before it touches production.
Branch protection, mandatory peer review, and CI gates before any deploy. Production access is locked behind reviewed pull requests.
Brakeman for Rails-specific static analysis and bundler-audit for known-CVE dependencies, run automatically on every commit.
Annual third-party penetration test scope covering authentication, multi-tenant isolation, and the applicant flow. Findings remediated on a tracked timeline.
Sentry-instrumented error monitoring, structured application logs, and on-call rotation for production-impacting incidents.
Found something? Email security@seeclickrent.com. We acknowledge within one business day and won't take legal action against good-faith research.
The team is trained on secure coding, OWASP Top 10, and tenant-data handling. Security expectations are documented and enforced in review.
Roles, scopes, and audit trails are baked into the platform—not bolted on.
Five distinct roles—technical admin, organization admin, account manager, sales agent, property owner—with policy-enforced boundaries on every controller action.
Agents and managers see only the buildings they're assigned to. Cross-tenant access is impossible by design—every query is scoped server-side.
Multi-factor authentication available for staff and admin accounts. Applicants log in with one-time passcodes—no shared passwords, no credential reuse.
Impersonation banner, activity timelines, and the admin bar make every privileged action visible to the user being acted on. Nothing happens silently.
Organizations can restrict sign-in to approved email domains, preventing rogue self-service signups inside your account.
Sessions expire automatically. Password resets and account changes trigger email confirmations. Lost devices can be remotely revoked by an admin.
We use multiple LLM providers, but the guardrails, budgets, and human review queues live in our platform—not theirs.
Prompts and outputs go to OpenAI, Anthropic, and Google AI APIs configured to disable training on customer data. Your leads and tour notes are not used to train foundation models.
Org-level budget caps and rate limits prevent runaway costs. Safety guardrails block prompt injection patterns and unsafe outbound content.
Outbound AI replies can route through a review queue before they reach a renter. Takeover, approve, and discard actions are one click away.
AI features are configurable per organization and per building. Turn them off entirely if your portfolio policy requires it.
A complete list of the third parties that process customer or applicant data on our behalf, what they receive, and what they're certified for.
| Vendor | Purpose | Data Categories | Region | Certifications |
|---|---|---|---|---|
| Digital Ocean | Application hosting and database | All application data | United States | SOC 2 Type II, ISO 27001 |
| Mailgun | Transactional email delivery | Email addresses, message bodies | United States | SOC 2 Type II |
| Twilio | SMS delivery and consent management | Phone numbers, message bodies | United States | SOC 2 Type II, ISO 27001 |
| Stripe | Payment processing and billing | Payment metadata (no raw card data) | United States | PCI DSS Level 1 |
| Plaid | Identity and bank-income verification | Identity attributes, bank metadata | United States | SOC 2 Type II |
| Tenant Alert | Credit and background screening | Applicant PII, screening reports | United States | FCRA-licensed |
| Weimark | Credit and background screening (alt provider) | Applicant PII, screening reports | United States | FCRA-licensed |
| Google (Gmail OAuth) | Lead email ingestion from listing portals | Inbox messages, sender metadata | United States | CASA Tier 2 verified |
| OpenAI | AI lead responder, summaries, document analysis | Lead messages, tour notes (training disabled) | United States | SOC 2 Type II |
| Anthropic | AI lead responder and summaries | Lead messages, tour notes (training disabled) | United States | SOC 2 Type II |
| Google AI | AI lead responder and summaries | Lead messages, tour notes (training disabled) | United States | ISO 27001, SOC 2 |
| Sentry | Error monitoring and alerting | Error metadata, scrubbed stack traces | United States | SOC 2 Type II, ISO 27001 |
| Rent Manager | PMS sync (customer-controlled integration) | Property, unit, prospect, and lease data | United States | Customer-controlled |
Backups, runbooks, and notification commitments are written down before they're needed.
We commit to notifying affected customers within 72 hours of confirming a security incident that materially impacts their data.
Daily encrypted database backups with point-in-time recovery, geographically separated from primary infrastructure. Restores are tested on a defined cadence.
Sentry alerts route to an on-call engineer with documented escalation paths. Status updates flow to the customer success team for downstream communication.
Documented runbooks cover credential compromise, vendor outage, data deletion requests, and disaster recovery. Reviewed and rehearsed regularly.
Security questionnaires (CAIQ, SIG-Lite), our CASA Tier 2 attestation letter, and a signed DPA are available on request under NDA. Send the questionnaire—we'll send it back filled in.