Workspace isolation
Workspace membership, database access policies, and server-side authorization govern access to customer records. Private documents and work-order media use authenticated, time-limited access. Tenant portal access is limited to the relevant tenant’s records.
Application controls
- Server-verified authentication and workspace membership.
- Owner, Admin, Manager, and Read-only roles; financial setup and credential management require direct authorized administrators.
- Server-side plan and usage enforcement; audit events for material workspace and lease actions.
- Human approval before extracted lease terms become active.
- File type and size checks, plus signed provider event verification.
- Bank and accounting access tokens are encrypted at rest and kept server-side.
Infrastructure and financial connections
TenantPoint uses HTTPS, security response headers, and managed hosting and data services. Stripe handles subscription checkout and eligible tenant ACH payment flows; Plaid supplies optional bank-account and transaction connections; QuickBooks Online is an optional accounting destination on eligible plans. Their roles are separate. Sensitive provider credentials stay server-side. See the Trust Center provider overview and Privacy Policy for the customer-facing data boundaries.
Current status and limitations
TenantPoint is not currently SOC 2 certified, ISO 27001 certified, or PCI DSS certified. Provider certifications are not TenantPoint certifications, and no software can guarantee the absence of security incidents. Optional multi-factor authentication is available: add an authenticator app in Settings → Security to require a six-digit code at sign-in. We publish evidenced controls, not future certifications.
Report an issue
Email hello@tenantpoint.co (or use the contact form) and do not access data that is not yours.