Security and data handling

Leases and reconciliations are confidential. Here is exactly what happens to them.

Where your documents go

• Hosting. The application and its database run on Fly.io in the United States, on encrypted volumes. All traffic uses HTTPS.
• AI processing. Document text is sent to AI models through OpenRouter, restricted to providers that do not store prompts or use them for training. Scanned pages may be read by Anthropic's Claude under the same restriction.
• Email. Outbound and inbound email runs through Resend. Letters go only to the landlord on file, after your approval.
• Payments. Cards are stored by Stripe. Tenantback never sees or stores card numbers.

Who can do what

• Workspaces are isolated: every query is scoped to your organization.
• Roles (owner, admin, member, viewer) control who can approve letters and recoveries.
• Passwords are hashed with Argon2; API keys are stored only as hashes; sessions use secure, HTTP-only cookies.
• No AI agent can send anything to a landlord or record money without passing the approval gate you configure.

Audit trail

Every agent step, tool call, decision, approval and email is logged with time and actor in an append-only audit log you can review in the app.

Email safety

Documents emailed to audit@tenantback.com are only accepted from senders whose domain passes DMARC or aligned DKIM, so nobody can push documents into your workspace or trigger reports by forging your address. Landlord replies are treated as untrusted input: the agents never follow instructions inside them.

Deleting your data

Email security@tenantback.com from the workspace owner's address and we will delete the workspace, its documents and its history.

Reporting a vulnerability

Write to security@tenantback.com. We respond within two business days.