Security & data

Built to protect the people behind every home

Isolation enforced in the database, sensitive data encrypted, and an audit trail nothing can quietly change — on a platform that holds tenants’, landlords’ and contractors’ most sensitive records.

B+Self-assessed posture against
ISO 27001 · NIST CSF · OWASP ASVS
For tenants

You only ever see your own home. Your data is private, and never sold.

For landlords

A tamper-proof record you can use to prove compliance, later.

For agencies

Client data is isolated per organisation, and audit-ready by default.

For contractors

You see only the job assigned to you — nothing else about the property or tenant.

14 controls, live today

What protects your data

Every control below is implemented and running in production — not a promise. Each shows the plain-English benefit, the technical detail, and how it maps to recognised frameworks.

Who can see what

Every record knows which organisation, role and user is allowed to touch it — and the database enforces it.

01AStrong
Tenant data isolationYou only ever see the world that belongs to you — your home, your properties, or the job you've been assigned. Row-Level Security is enforced at the database layer (organisation_id + membership), so app bugs can't leak cross-tenant data.
ISO A.8.3 / A.5.15NIST PR.AA-05OWASP ASVS V4
02AStrong
Role-based accessEach role gets exactly the access it needs and nothing more. A 9-role hierarchy is enforced in RLS policies; contractors are scoped to assigned jobs only.
ISO A.5.15 / A.5.18NIST PR.AA-05ASVS V4
03AStrong
Isolation is actively testedThe "you can't see other people's data" rule isn't trusted — it's proven. Around 35 automated RLS contract tests attempt cross-tenant access on every release and must pass before code ships.
ISO A.8.29NIST PR.AAASVS V4

Files & sensitive data

Documents are private by default. Right to Rent — the highest-stakes data we hold — gets the strongest lock.

04BSolid
Private document storageYour files can't be reached by a guessed or shared link. No public storage buckets are used; everything sits in private buckets, with a separate locked store reserved for Right to Rent.
ISO A.8.12 / A.5.23NIST PR.DSASVS V12
05AStrong
Time-limited file accessA document link works only for you, and only briefly. Signed URLs are generated by the server after a permission check; raw storage paths are never exposed to the browser.
ISO A.8.3NIST PR.AA-05ASVS V12
06AStrong
Right to Rent protectionThe most sensitive ID and immigration data gets the strongest lock. Stored in a separate bucket with 5-minute links; share code and date of birth are field-level encrypted via pgcrypto, with a key the application never reads, held in a vault.
ISO A.8.24 / A.5.34NIST PR.DS-01ASVS V6

Accountability

If something happens, you can prove what happened — and to whom.

07AStrong
Tamper-proof audit logAn honest, unchangeable record of who did what — useful for proving compliance. Every change is written to an append-only audit_log; database triggers physically block edits and deletes; records carry actor, organisation, action, entity and changed fields.
ISO A.8.15 (+log protection)NIST DE.AE / PR.PSASVS V7
10BSolid
Safe email handlingTest environments can't accidentally email real people; every real email is logged. Sending is dry-run by default; each delivery is recorded with recipient and status.
ISO A.5.14 / A.8.16NIST DE.CM
15BSolid
Breach-response runbookIf anything ever goes wrong, we respond fast and correctly. A documented incident-response procedure backs an in-app breach record that starts the 72-hour ICO clock, tracks containment and risk assessment, alerts as the deadline nears, and generates ICO and data-subject notification drafts for review.
ISO A.5.24–A.5.26NIST RS.MA / RS.COUK GDPR Art.33–34
16BSolid
Scheduled retention & legal holdsData isn't kept forever, and disputed data isn't lost. A scheduled job reviews records against each defined retention period, lists what's due to be removed, and automatically preserves anything under an active legal hold — so information tied to a live dispute is never deleted while it matters. Destructive removal is reviewed against the dry run before it's switched on.
ISO A.5.33 / A.8.10NIST PR.DS / GV.POUK GDPR Art.5(1)(e) / 17 / 18

Encryption, secrets & login

What's on the wire is sealed. What grants power lives where the app can't see it.

08AStrong
Encryption in transitEverything you send and receive is sealed in transit. HTTPS/TLS is enforced via HSTS (preload) plus hardening headers (CSP, X-Frame-Options DENY, nosniff, Referrer-Policy, Permissions-Policy).
ISO A.8.24 / A.5.14NIST PR.DS-02ASVS V9
09BSolid
Secrets kept out of reachPowerful keys never touch your browser or our application code. Secrets live in server config only; the most powerful database key is restricted to back-office jobs; the Right to Rent encryption key lives in a vault.
ISO A.8.24 / A.8.4NIST PR.AAASVS V6
17BSolid
Encryption at restYour data is encrypted where it's stored, and the most sensitive identity details get a second lock. Everything sits on full-disk-encrypted infrastructure; on top of that, the highest-risk identity fields — Right to Rent share codes and dates of birth, and the ID-document numbers captured in anti-money-laundering checks — are individually encrypted at the field level with keys held in a vault, so they stay unreadable even to someone with raw database access.
ISO A.8.24 / A.8.11NIST PR.DS-01UK GDPR Art.32
12BSolid
Secure loginTrusted, standard sign-in via Supabase Auth with JWT sessions: email + password (minimum length enforced, and the address must be confirmed before the first sign-in), magic link, or Google. Confirmation is verified server-side, with a fresh link re-sendable from the sign-in screen. Two-factor authentication (authenticator-app TOTP) is enforced for every account, with single-use backup codes for recovery.
ISO A.5.16 / A.5.17 / A.8.5NIST PR.AA-01 / 02ASVS V2

Where it lives, who handles it

EU-hosted, under strong data-protection law, with a tight third-party footprint.

13BSolid
EU data hostingYour data sits inside the EU, under strong data-protection law. Hosted on AWS Ireland (EU region) and covered by UK–EU data-protection adequacy. UK residency is on the roadmap if customers require it.
ISO A.5.23 / A.5.34UK GDPR Art.44–46
14BSolid
GDPR foundationsClear privacy rights, a published privacy policy, defined retention periods, and stated controller/processor positions — LetTrack acts as processor for data uploaded by landlords and agencies. Data-subject-request structures are in place.
ISO A.5.34UK GDPR Art.5 / 12–22
11BSolid
Minimal third partiesYour data isn't sold or scattered across vendors. We use Supabase (data and storage), Resend (email), Stripe (payments, currently off), and Sentry (error alerts). No onward data sharing.
ISO A.5.19–A.5.23NIST GV.SC
Honest by default

We tell you what isn’t done yet.

Security claims should be conservative. Everything above is live; everything still to come is listed below, clearly labelled — no theatre.

B+
An honest, improving posture.

Self-assessed against ISO 27001:2022, NIST CSF 2.0 and OWASP ASVS. Strong on isolation, audit and encryption; the roadmap below closes the remaining gaps before we’d ever claim a higher grade.

On the roadmap · not yet shipped

What we’re building before launch

These items are not yet live. They are presented in full — so you can hold us to them when they ship.

  1. 01Coming
    UK data residency (if required)Data held in the UK, not only the EU, for customers that need it.
    target: A Strong
  2. 02Coming
    Upload malware scanningFiles checked for malware before anyone opens them.
    target: B Solid
  3. 03Coming
    One-click GDPR erasure & exportRequest deletion or export of your data, and it happens — end-to-end.
    target: A Strong
  4. 04Coming
    Formal GDPR governanceArticle 30 register and sub-processor list maintained in-app; ICO registration in progress; DPO contact and legal sign-off to follow.
    target: A Strong
  5. 05Coming
    Independent security audit / pen-testThird-party proof, not just our word.
    target: A Strong

The small print

  • Ratings are self-assessed. A, B and C labels reflect our own mapping against ISO 27001:2022, NIST CSF 2.0 and OWASP ASVS — they are not externally audited certifications. An independent assessment is on the roadmap.
  • Demo numbers are demo numbers. The illustrative figures shown elsewhere on the marketing site (property counts, percentages, sample timelines) are not live security metrics.
  • Found something we should fix? Security disclosures are welcome at security@lettrack.co.uk.

Questions about how we protect your data?

We’d rather have the conversation than oversell. Reach out and we’ll walk you through any of the controls above — or the gaps still on the roadmap.

Email the security team Start your trial