Security at RentEase

All card data is handled exclusively by Stripe, our PCI-DSS Level 1 payment processor. RentEase servers never receive, store, or transmit raw card numbers, CVV codes, or full bank credentials. When you add a card in our app, your browser talks directly to Stripe; RentEase keeps only a tokenized reference (typically the last four digits, brand, and expiry) so we can charge you later.

When you link your bank account for ACH debits or receive payouts, you do so through our bank-verification partner (Plaid-class). Your bank credentials enter the partner's environment, not ours. Only an opaque, scoped token lives in RentEase's database — enough to initiate the transfers you have authorized, nothing more.

Every request to RentEase and every response from us is encrypted with TLS 1.2 or higher. HSTS is preloaded so downgrade attacks and cookie hijacking over plaintext are rejected at the browser. A strict Content-Security-Policy is enforced at the edge to block cross-site scripting and other injection vectors.

Database storage is encrypted at the disk layer. Application secrets are never hardcoded — they are read at runtime from environment variables injected at deploy time. Database credentials, signing keys, and third-party API keys live in a managed secret store, not in source.

Sessions are issued by our authentication provider as signed, httpOnly, Secure cookies with SameSite=Lax. They are rotated on sign-in and on privilege escalation, and expire automatically after a long period of inactivity. We do not rely on browser-local storage for session state, so a hostile extension cannot lift your session.

Two-factor authentication is available from your account settings and recommended for landlord accounts that initiate payouts.

Every database query in the RentEase codebase is scoped to the signed-in user: a renter can read only their own plans and installments; a landlord can read only their own properties and payouts. Admin endpoints are additionally gated by role checks, and every admin action is logged.

Linked bank accounts and stored payment methods are stored under the same per-user ACLs — no employee “shadow” access path exists.

The following protective headers are set on every response:

• HSTS — HTTPS-only, preloaded.
• Content-Security-Policy — strict default with per-request nonces; blocks inline scripts and untrusted frames.
• X-Frame-Options: DENY and frame-ancestors 'none' — you cannot be embedded in another site.
• Referrer-Policy: strict-origin-when-cross-origin — referrers only reveal your own origin to third parties.
• Permissions-Policy — restricts unused browser features (camera, microphone, geolocation) by default.
• Cross-Origin-Opener-Policy and Cross-Origin-Resource-Policy — protect against cross-window data leaks.

Honest status: RentEase is in the early stage of building toward a SOC 2 Type II attestation. We are not yet certified. We follow the same controls catalog (security, availability, processing integrity, confidentiality, privacy) as a guide for our internal practices today, and we will publish the letter here once it is issued.

For the latest status, email security@polsia.app.

We operate a documented incident response plan with four phases:

1. Detection. Alerts from our monitoring and anomaly detection are paged to the on-call engineer within minutes.
2. Containment. Affected systems are isolated, tokens rotated, and the blast radius scoped before any remediation touches the rest of the codebase.
3. Notification. Affected users receive notice by email and in-app within 72 hours where required by law (GDPR, US state breach-notification statutes), and sooner for anything that puts funds or credentials at risk.
4. Postmortem. A public, scrubbed summary is published for any incident that affected a population larger than a single test account.

We welcome reports from security researchers. If you believe you have found a vulnerability in RentEase, please email security@polsia.app (or rent-ease@polsia.app if the dedicated inbox is not yet provisioned).

Our commitments to you:

• Acknowledgement within 2 business days.
• Triage within 5 business days.
• No legal actionagainst good-faith research that complies with our responsible-disclosure terms (no social-engineering, no spam, no denial-of-service, no accessing other users' data).
• Credit in our public hall of fame once the report is resolved.

Need an attestation letter for a vendor review or audit? Email security@polsia.app and we will send the most recent version available.