Security

Every connection to Rentova — the website, the application, the portals and the API — uses HTTPS (TLS). Browsers are told to keep using HTTPS (HSTS), and the application sets a content security policy that limits where scripts and data may load from.

Sensitive fields are encrypted before they are stored, using AES-256-GCM with a key that lives only on the server, never in the database. That covers integration credentials (payment, email, accounting and banking connections) and tax identifiers such as an organization's EIN, which is shown back only as its last four digits. Passwords are never stored: they are hashed with bcrypt. Database backups are encrypted before they are written.

Rentova is multi-tenant: many organizations share one platform. Every record carries the organization it belongs to, and every query is scoped to the signed-in user's organization on the server, not in the browser. Tenants, owners and vendors sign in to separate portals that can see only what has been shared with them. An automated cross-organization isolation test runs against every release.

• Role-based permissions (administrator, property manager, assistant manager, accountant and maintenance staff) limit what each user can see and change.
• Two-factor authentication with an authenticator app is available to every user and required for platform operators.
• Sessions use short-lived tokens in secure, HTTP-only cookies with cross-site request forgery protection; you can review and revoke active sessions in Settings.
• Sign-in, password reset and other sensitive endpoints are rate-limited to slow down credential attacks.
• Sensitive actions are written to an audit log with who, what and when, including acceptance of legal documents.

Uploaded documents and photos are served only to signed-in users of the organization that owns them. Uploads are checked by content, not just file name, and executable file types are refused.

The database is backed up daily. Backups are encrypted, retained on a rolling schedule, and restore procedures are rehearsed rather than assumed. Hosting is on servers under our control with the application reachable only through the web front end.

If you believe you have found a security problem in Rentova, email beta@rentova.com with enough detail to reproduce it — affected URL or endpoint, steps, and impact. A machine-readable copy of this contact is published at /.well-known/security.txt (RFC 9116) for scanners and disclosure tooling.

Scope. In scope: the Rentova web application and API, the tenant, owner and vendor portals, and this marketing site. Out of scope: denial-of-service or load testing, spam or social engineering against our staff or customers, physical access attempts, and any third-party service we integrate with (Stripe, Plaid, our email and SMS providers) — report those to the provider directly. Automated scanning is welcome at a reasonable rate; stop and report immediately if a test starts to degrade the service for others.

What we ask. Test only against your own account and data. Do not access, modify or exfiltrate another organization's data beyond the minimum needed to prove a finding. Do not use a finding for anything beyond verifying and reporting it. Give us a reasonable chance to fix an issue before disclosing it publicly.

What you can expect. We aim to acknowledge a report within three business days, confirm or explain our assessment within ten business days, and keep you updated as we work on a fix — these are our current goals, not a contractual commitment. Good-faith research that stays within this scope and these guidelines will not be referred for prosecution or result in legal action from us, and applies regardless of whether the platform's Terms of Service or Beta Agreement would otherwise restrict this kind of testing.

For how we handle personal information, see the Privacy Policy.