Encrypted network connections
HTTPS/TLS protects traffic between your browser and RentalMind. Neon requires encrypted TLS connections to the database, helping protect information as it moves between the application and its data storage.
Security at RentalMind
Security for your business data.
RentalMind combines encrypted storage, scoped access controls, protected authentication, and managed cloud infrastructure to safeguard property information and business operations.
Data encryption
Encrypted connections and storage, with AES-256-GCM protection for designated sensitive fields.
Scoped access controls
Individual permissions, property assignments, and separate access scopes for users and AI agents.
Secure payment processing
Stripe-powered billing with PCI Level 1 certified processing, encrypted payment data, and fraud detection.
AI data protection
Permission-aware knowledge retrieval and commercial AI processing that excludes general model training.
Data ownership and control
Customer content ownership, permission-controlled property exports, and data access and deletion requests.
Managed cloud infrastructure
Vercel application hosting, Neon database security, private document storage, and ongoing engineering support.
Encryption
Encryption for data in transit and at rest.
RentalMind combines encrypted network connections, provider-managed storage encryption, and application-level encryption for designated sensitive information.
AES-256 storage encryption
Neon encrypts stored database data using AES-256. Vercel Blob applies AES-256 encryption at rest to uploaded files, providing encryption at the storage layer.
Application-level encryption for sensitive fields
Designated fields for property access codes, Wi-Fi passwords, bank account details, and utility account numbers use AES-256-GCM authenticated encryption. This adds a separate layer of protection for those values and checks the integrity of encrypted data when it is decrypted.
One-way password hashing
Account passwords are protected with salted bcrypt hashes. Sign-in verifies the supplied password against its hash, so RentalMind does not need to store a readable account password.
Provider controls: Neon security and Vercel Blob security.
Access control
Granular authorization for users and AI agents.
Workspace boundaries, individual permissions, and property assignments control access to business information and operational actions. Permissions can be tailored to each person or agent.
Workspace isolation
Properties, knowledge, team membership, and billing are scoped to their workspace. Authorization checks use the active workspace and its membership, keeping access separate when a user belongs to multiple organizations.
Individual permission management
Roles provide a starting point, with permissions adjustable for each user in Settings >> Team. Administrators can control access to properties, tasks, SOPs, business information, and financial details, including the ability to view information or make changes.
Property-level access restrictions
Users can be assigned access to all properties or selected properties. This allows cleaners, co-hosts, and other team members to work with their assigned homes while restricting access to the rest of the portfolio.
Dedicated AI agent identities and scopes
AI agents, offered in early access, have their own identities, permissions, and property assignments. Read only, Full access, and Custom settings control their operational scope. Agent permissions exclude billing and user-access administration, and agents cannot be assigned an administrator role.
Access updates and connection revocation
Permissions can be revised as responsibilities change. Saved agent permission changes apply to already connected applications without requiring reconnection. Individual AI app connections can also be disconnected without deleting the agent.
Two-factor authentication and account recovery
Users can enable authenticator-based two-factor authentication from Settings >> Security. An additional verification step protects sign-in, while single-use recovery codes provide an alternative if the authenticator is unavailable. Recovery codes are stored as one-way hashes.
Sign-in and account-operation rate limits
Rate limits help restrict repeated password attempts, verification-code requests, and sensitive account operations. These controls reduce the opportunity for automated guessing and abuse.
Time-limited, audited support access
An authorized administrator can grant temporary workspace access from Settings >> Support access. Grants expire and can be revoked at any time, without sharing an account password. Changes made during support sessions are logged and visible to the workspace.
Payments
Payment security powered by Stripe.
RentalMind uses Stripe to process subscription payments and manage billing, combining independently audited payment infrastructure with encryption, tokenization, and fraud prevention.
PCI DSS Level 1 certified processor
Stripe is independently audited as a PCI DSS Level 1 service provider, the highest service-provider level in the payment card industry. This certification applies to the Stripe infrastructure that processes payment information.
Encryption in transit and at rest
Stripe protects payment information in transit using TLS 1.2 or later and encrypts stored card numbers with AES-256. Payment card data is held in a separate vault with restricted access.
Tokenized payment details
Payment details are collected directly by Stripe through its secure payment components and represented by payment-method identifiers for billing. RentalMind does not store full card numbers or card security codes.
Fraud detection and screening
Stripe Radar evaluates supported payments using machine learning and signals from the Stripe network to help identify and block fraudulent transactions.
Cardholder authentication
Stripe supports 3D Secure authentication, including additional verification when required by the issuing bank or applicable payment rules. Your bank may ask you to confirm a payment with a code, banking app, or another verification method.
Secure billing management
Access the Stripe customer billing portal from Settings >> Billing to manage your subscription and payment method. Cancellation and access follow the terms of your plan.
Learn more about Stripe security and data protection.
AI and your data
Secure AI processing and controlled data access.
Macaw combines permission-aware retrieval with commercial AI services to search business knowledge and support operational work. Data access is governed by workspace permissions and the processing terms of the services involved.
Permission-aware knowledge retrieval
Macaw retrieves information within the active workspace and applies feature permissions and property access restrictions. These controls determine which property records, SOPs, contacts, and business information can be used to answer a request.
Customer content excluded from general model training
RentalMind uses Anthropic's commercial API and Voyage AI with its model-training opt-out enabled. Customer documentation is processed to provide the AI features and is excluded from general-purpose model training under those arrangements.
Defined processing and retention terms
Anthropic processes requests and relevant context to generate AI responses. Voyage AI processes content for search. Each provider handles data under its applicable commercial terms and retention policies; exclusion from model training is separate from request retention.
Protected access-code retrieval
Macaw uses a protected lookup to retrieve designated property access codes. Disclosures through that lookup are recorded, providing visibility into access to those sensitive values.
External AI connection controls
Connected AI applications operate through authorized workspace access. Their providers also handle the information retrieved for them under their own terms. Connection permissions can be reviewed, narrowed, or revoked through the applicable settings.
Provider details: Anthropic retention and Voyage AI terms.
Data governance
Data ownership and lifecycle controls.
RentalMind provides controls for accessing and exporting business information, with collection, processing, sharing, and retention described in the Privacy Policy and Terms of Service.
Customer content ownership
Your organization retains ownership of the business content it submits to RentalMind. The Terms of Service define the permissions required to host and process that content to provide the service.
Permission-controlled property exports
Authorized users can export selected properties as a ZIP of individual text documents. Exports respect property access permissions and offer section selection, allowing the content of an export to be tailored before it is shared with another service.
Data access and deletion requests
Requests for data access or deletion can be submitted to hello@rentalmind.ai. Data retention and account termination are governed by the Privacy Policy, Terms of Service, and applicable legal obligations. Property documents can be exported while account access remains active.
Infrastructure
Managed infrastructure and operational security.
RentalMind runs on Vercel and Neon, combining managed application hosting, encrypted data services, controlled file delivery, and an ongoing engineering engagement.
Managed application hosting and DDoS protection
Vercel hosts the application and provides automatic platform-level DDoS mitigation to identify and filter abnormal attack traffic. This adds infrastructure protection alongside the access controls implemented in RentalMind.
Managed database security
Neon manages the Postgres database, including encrypted connections, encrypted storage, and the security of its underlying database infrastructure. RentalMind applies workspace and user authorization within the application.
Private document and image storage
Knowledge documents and editor images are stored privately in Vercel Blob and delivered through controlled application routes. Authentication and workspace checks protect ordinary access; content intentionally shared through a public sharing feature is accessible through its share link.
Sensitive-data masking in product analytics
Product analytics and session replay help identify usability issues. Access codes, Wi-Fi passwords, secret custom fields, Macaw chat text, and form inputs are masked or excluded. Pages displaying API keys, connection details, or two-factor setup are excluded from replay.
Ongoing platform maintenance
Fulcrum Insights, RentalMind's engineering partner, is responsible for platform maintenance, hosting management, and security patches under an ongoing engagement.
Infrastructure details: Vercel DDoS mitigation and Neon security program.
Provider security
Security standards across our service providers.
Our core infrastructure and payment providers, including Vercel, Neon, and Stripe, maintain independently audited security programs aligned with recognized industry standards. Their controls support our hosting, data storage, and payment processing, alongside RentalMind's application-level encryption and access controls.
Frequently asked questions
Security FAQ
How is business data encrypted?
Browser traffic uses HTTPS/TLS, Neon requires encrypted database connections, and Neon and Vercel Blob encrypt stored data with AES-256. Designated sensitive fields have an additional application-level layer of AES-256-GCM encryption. Account passwords are protected with salted bcrypt hashes.
How can I strengthen account security?
Use a unique password and enable authenticator-based two-factor authentication in Settings >> Security. Store the single-use recovery codes securely and review team permissions when responsibilities change.
Can access be restricted to specific properties?
Yes. Settings >> Team supports selected-property assignments and individual feature permissions. A person can be given access to the properties and functions their work requires.
Can AI agent permissions be restricted independently?
Yes. For workspaces with AI agents enabled, each agent has its own permission settings and property assignments. Agents can be read-only or permitted to make selected changes. Saved permission updates apply to connected apps, and agents cannot be made administrators or granted billing or user-access administration permissions.
How do AI providers process business information?
Anthropic processes requests and relevant workspace context for AI responses, while Voyage AI processes content for search. Customer content is excluded from general model training under the commercial API arrangements and Voyage training opt-out. Provider retention policies still apply, and external assistants you connect have their own processing terms.
How can I export information or request deletion?
Authorized users can export selected property documents from Properties >> Export. Contact hello@rentalmind.ai for other data access or deletion requests. The Privacy Policy and Terms of Service describe retention and account termination; export needed property documents while account access remains active.
How is support access controlled?
An authorized administrator grants time-limited in-app support access and can revoke it at any time. Changes made during a support session are logged and visible to the workspace. Authorized infrastructure access remains necessary to operate and maintain the service.
Security inquiries
Contact our team with questions about platform security, data handling, or specific security controls.
hello@rentalmind.aiVulnerability reporting
Report suspected security vulnerabilities privately, including a description and steps to reproduce. Reports should exclude customer data and live credentials.
hello@rentalmind.aiFor the details of how information is collected, processed, shared, and retained, read our Privacy Policy and Terms of Service.