How we protect your data

• We never store your password. We store a one-way bcrypt hash of it.
• If you forget your password, the reset link we email can be used once and stops working after 30 minutes.
• We send at most 3 reset emails to an account per hour, and the reset page does not reveal whether an email address has an account.
• Setting a new password through a reset link signs you out on every device and forgets any devices you had trusted for two-factor authentication.

• Each sign-in opens a session tied to the device you used. The device is identified by a random value in a cookie that page scripts cannot read and that our server signs, so it cannot be guessed or forged.
• An account can be signed in on up to 5 devices at once. Signing in on another device signs out the one used least recently.
• When a session is ended, its tokens stop working straight away.
• Access tokens stop working after 30 minutes and are renewed automatically while your session is still active.

• Some changes need you to enter your password again first: bank and payout details, creating, editing or deleting roles, inviting or removing team members, and deleting an organisation.
• If two-factor authentication is on, you also need a code from your authenticator app.
• The confirmation lasts 10 minutes and only on the device where you gave it.

• You can turn on two-factor authentication with an authenticator app from your profile. Once it is on, signing in needs a code from the app (or a backup code) as well as your password.
• You can choose to trust a device for 30 days so it does not ask for the code again. Five wrong codes in 15 minutes pause the second step for a while.
• When you turn it on you get 10 single-use backup codes. We store only a hash of each code.
• You can create new backup codes at any time. Doing so cancels the old ones.

• Sign-in, token renewal, verification codes, registration and password reset are limited per IP address, which slows down password guessing and spam sign-ups.
• Other changes are limited per signed-in user, so one account cannot overload the service.
• Requests with very large bodies are refused before they are processed.

• Every user acts within an organisation and has a role, such as Account Owner, Property Manager, Caretaker, Property Owner, Agent or Tenant.
• Roles are built from granular permissions, for example viewing tenant contact details or recording payments. Custom roles can be created from the same permissions.
• A role can be limited to the whole organisation, to chosen portfolios, properties or apartments, or to a person's own records.
• Each organisation's records are kept apart. The server decides which organisation a request belongs to, and a record from another organisation is answered as if it does not exist.

• Sign-ins (including failed ones), password re-confirmations, ended sessions, exports and changes to records are written to an audit log with the time, the person, the IP address and the browser.
• Every request refused for missing sign-in, missing permission or too many attempts is also logged, so probing leaves a trail.
• Passwords, tokens, NINs, BVNs and ID numbers are masked in audit entries.
• Email addresses and phone numbers are replaced with pseudonymous references in our server logs.

• Card payments are made on Paystack's payment pages. Full card numbers and security codes go to Paystack, not to us.
• We keep only what Paystack returns: references, amounts, the card type, the last four digits and the expiry date, and an authorisation code for saved cards.
• Payment notifications from Paystack are only accepted if their signature checks out against our Paystack secret key. If no key is configured, every notification is refused.

• Tenant and application documents and personal data exports are kept in private storage and are only available through the platform.
• Maintenance photos are private too: only the tenant who reported the issue and staff of that landlord's account can open them.
• Property photos and profile photos are shared by link, so anyone with the link can open them.
• A personal data export can be downloaded for 7 days and at most 3 times.

• Our API sends headers that tell browsers to connect over HTTPS only (HSTS), not to show its responses inside other sites' frames, and not to guess file types.
• When the platform runs in production mode, the device cookie is only sent over encrypted connections.

• The platform includes a backup tool that copies the full database and every stored file. File copies are listed with a checksum, and a database copy that is too small to be real is rejected.

How often backups run and where copies are kept: [To be supplied: Backup schedule and storage location]