Trust

How your data is protected

Property managers put resident and applicant records in PropLane, and some of those records are among the most sensitive a person has. This page says plainly what we do to protect them, and where the limits are.

Last updated: September 7, 2026

What we do

Encrypted connections and storage
Information travels between your device and PropLane over HTTPS. Our database provider also encrypts stored customer data at rest.
An additional layer for sensitive information
Selected applicant and co-signer identity fields, application-uploaded documents, and connected-calendar credentials are encrypted before they are stored, using encryption keys kept separately from the database. Existing records covered by this layer have been migrated.
Controlled access
Protected application records and documents are only reachable through authenticated, permission-checked routes. Direct browser access to the sensitive application, co-signer and calendar tables is blocked, and application document storage is private.
Ongoing security checks
We review security-sensitive changes, test unauthorized access attempts, scan dependencies and source code, and fix what we find. Our testing includes open-source security tooling from Trail of Bits.

What this does not mean

No system is beyond compromise, and we would rather tell you exactly where the edges are than overstate them.

The additional encryption layer covers the records named above. Other data — for example lease documents, free-text answers and routine account records — relies on the provider's encryption at rest and on access controls, not on the additional layer.
Someone signed in to an account, or an attacker who compromises a running server, can see what that account is allowed to see. Encryption protects data at rest; it does not replace strong passwords and careful account sharing.
Our security testing uses open-source tooling and our own reviews. It is not an independent audit, penetration test, SOC 2 report or HIPAA assessment.

Your data stays yours

You can delete your account from Settings at any time; a deletion removes your records so the same email address can start again on an empty account. How we collect and use information is set out in our Privacy Policy.

Questions or a security concern

Write to support@prop-lane.space with the word “security” in the subject. If you believe you have found a vulnerability, please include enough detail for us to reproduce it and give us a reasonable window to fix it before sharing it publicly.

What we do

Encrypted connections and storage

Information travels between your device and PropLane over HTTPS. Our database provider also encrypts stored customer data at rest.

An additional layer for sensitive information

Selected applicant and co-signer identity fields, application-uploaded documents, and connected-calendar credentials are encrypted before they are stored, using encryption keys kept separately from the database. Existing records covered by this layer have been migrated.

Controlled access

Protected application records and documents are only reachable through authenticated, permission-checked routes. Direct browser access to the sensitive application, co-signer and calendar tables is blocked, and application document storage is private.

Ongoing security checks

We review security-sensitive changes, test unauthorized access attempts, scan dependencies and source code, and fix what we find. Our testing includes open-source security tooling from Trail of Bits.

What this does not mean

No system is beyond compromise, and we would rather tell you exactly where the edges are than overstate them.

The additional encryption layer covers the records named above. Other data — for example lease documents, free-text answers and routine account records — relies on the provider's encryption at rest and on access controls, not on the additional layer.

Someone signed in to an account, or an attacker who compromises a running server, can see what that account is allowed to see. Encryption protects data at rest; it does not replace strong passwords and careful account sharing.

Our security testing uses open-source tooling and our own reviews. It is not an independent audit, penetration test, SOC 2 report or HIPAA assessment.