Security at Property Station

We would rather tell you exactly what is in place than use the word "enterprise". Everything below describes the Service as it runs today. Where a control is still in progress we say so.

Your data is isolated at the database

Every table that holds customer data is protected by row-level security rules in PostgreSQL. A query from your session can only return rows that belong to you (or, for a builder team member, to your organization, within your role). This is enforced by the database on every request, not by application code that could forget to check. The rules are exercised by an automated test suite on every change, including direct attempts to read or write across accounts and across builder organizations.

The builder handoff has its own rules: a builder can only invite a buyer to a home it owns, a claim only succeeds for the invited email once it is confirmed, invitations expire after 14 days, and after a claim the builder's access to that home's record ends.

Files are private

Documents and photos are stored in private storage buckets with the same per-account access rules. Nothing you upload has a public URL. When you open a file the app issues a link that works for one hour and then stops. Share links, which you turn on yourself, expose only property details, systems, and rooms, never files.

Encryption

All traffic to and from propertystation.com uses HTTPS, and the site sends a Strict-Transport-Security header (two years, including subdomains, preload) so browsers refuse to connect insecurely. Data is encrypted at rest by our database and storage provider, Supabase. Backups are encrypted.

Authentication

Sign-in is handled by Supabase Auth. You can use Google sign-in or an email and password; passwords are hashed and never stored in plain text. New email accounts must confirm their address before they can claim a builder-provided home. Sessions are carried in secure, HTTP-only cookies. Password resets go through a time-limited emailed link.

Hardening on every response

Every page is served with a set of security headers: X-Frame-Options: DENY (the site cannot be embedded in another site), X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin, Cross-Origin-Opener-Policy: same-origin, and a Permissions-Policy that disables camera, microphone, and geolocation. Scheduled background jobs require a secret and reject unauthenticated calls. AI features have per-account usage limits and a global spending circuit breaker.

How we build and ship

Changes reach production only through a protected main branch. Each change runs continuous integration: type checking, linting, unit and security tests against a fresh database, the row-level-security test suites, an accessibility check, a production dependency vulnerability audit that must be clean, and browser tests against a production build. A security review of the whole platform was carried out in July 2026 and its findings were fixed before the site opened. Uptime is monitored continuously, and named people are alerted when it drops.

Backups and recovery

Our database provider takes daily backups, and we keep our own periodic logical backups of the application data off-platform. We are working toward a rehearsed, timed full-restore drill that includes user accounts and file storage; until that drill is complete and measured we do not publish a recovery-time commitment. You can download everything in your account at any time from Settings → Data Export, and we encourage you to keep your own copies of documents that matter.

What we do not do

We do not sell your data. We do not run advertising or third-party analytics trackers. We do not train AI models on your content, and we have not authorized our AI provider to do so. We do not store payment card numbers; if paid plans launch, a payment processor will handle cards and we will not see them.

Reporting a security issue

If you find a vulnerability, email support@propertystation.com with "Security" in the subject line. Tell us what you found and how to reproduce it. We will acknowledge the report, keep you informed as we fix it, and credit you if you want. Please do not access other people's data, degrade the Service, or publish the issue before we have had a reasonable chance to fix it. We do not currently run a paid bug bounty.

Questions

Ask at support@propertystation.com. Our Privacy Policy covers what we collect and who processes it; the Terms of Service cover the agreement between us.