Access to property data should follow responsibility.

Isolation and scoped permissions.

The backend foundation enforces agency context and permission checks on protected routes. Branch and team scopes are explicit. Role and invitation tests cover privilege limits and rejection of access outside the permitted context. These are local validation results, not a claim of a completed external certification.

• Tenant-scoped access enforcement
• Role and resource permissions
• Controlled invitations and privilege boundaries

Authentication and support boundaries.

Password sessions, multi-factor authentication and passkey foundations have been implemented and tested locally. Support access requires an authorised, time-limited grant and is read-only. The support context is visible, and revocation ends access.

Private records and audit context.

Private document access is designed around scoped authorisation and expiring delivery. Identity and settings changes retain actor and revision context. Public inquiry content is encrypted at rest in the lead module and is not exposed by any public listing or read endpoint.

Integration and recovery readiness.

Provider credentials are designed to remain encrypted and write-only. Live provider adapters, full operational exports and production backup/restore acceptance remain release requirements. We do not claim verified recovery objectives, certified compliance or a production provider connection before evidence exists.

Discuss your data requirements.

Use the contact form to ask about access boundaries, export needs, retention or procurement requirements. Do not include passwords, payment information or sensitive guest documents in a public inquiry. No ISO 27001, SOC 2 or GDPR certification is claimed.