Security and control
Who can do what, what cannot be undone, and how you leave
Three questions worth asking any system that will hold your landlords' bank details and your books. Here are our answers, including the part about leaving.
Who can do what
Access is granted by role rather than per person, so a new member of staff inherits a known set of permissions instead of an ad-hoc collection someone assembled by hand.
There is a dedicated accountant role that sees the financial module and not the day-to-day operational screens. That separation matters for a rental office: the person reconciling the ledger should not be the person editing a contract's rent, and an auditor will ask about it.
There is also a lawyer role for offices with in-house counsel, which can view cases and edit assigned ones but cannot post to the ledger or delete a case. Landlords, notably, have no user account at all — the portal they use is not a login to your system.
What cannot be quietly undone
A posted journal is permanent. It is never edited and never deleted. A correction is made by reversal, which writes an equal and opposite journal and marks the original as reversed — so the correction is visible in the record rather than hidden by the absence of what used to be there.
Accounting periods can be locked. Once a period is closed, any attempt to post or reverse a journal dated inside it is refused before it is written, including postings generated automatically by the invoicing, maintenance and legal modules.
Several immutable logs run underneath: the accounting audit log, an invoice status log recording every state change, an invoice email log recording every delivery, a legal audit trail, and the approvals record of who approved which change and when. None of these can be altered from inside the application.
Sent invoices are snapshotted as a PDF on first send, so the document a client received cannot later be silently different from the document you hold.
The landlord portal, specifically
Giving clients access to a system is normally where security gets complicated. This portal avoids most of that by having nothing to write to.
It exposes no endpoint that changes data — not restricted ones, none at all. The only action a landlord can take is signing out. Sign-in tokens are stored only as hashes, never in a form that could be read back. Every query is bound on the server to the landlord who is signed in, and any record identifier appearing in a URL is re-verified against that binding, so editing an address cannot reach another landlord's records.
Your office grants first access. A landlord cannot enrol themselves; the most they can do is ask for their existing link to be sent again, and access can be revoked at any time.
Getting your data out
The most important security question about a SaaS product is whether you can leave it. You can, at any time, without asking us and without a request process.
- Landlords, buildings, units, tenants, contracts and cheques export to CSV from their listing pages
- All eight financial reports export to CSV
- The raw journal ledger exports in full
- Invoices, payments and credit notes export with their history
- Maintenance tickets and vendor records export to CSV
- Legal cases export with fees and recoveries
- Contract and portfolio PDFs can be generated at any time
- No minimum term on monthly billing, and no cancellation penalty
Security questions
Can someone delete a transaction to hide a mistake?
No. Posted journals cannot be edited or deleted by anyone, at any permission level, from inside the application. The only way to correct one is a reversal, which writes an opposite entry and flags the original — leaving both visible in the ledger and in the audit log.
Can our accountant have access without seeing everything else?
Yes, that is exactly what the accountant role is for. It opens the financial module and leaves the operational screens closed, so an external or part-time accountant can reconcile and report without being able to alter contracts, cheques or landlord records.
What stops a staff member changing a landlord's bank details?
By default, role permissions. Beyond that, the governance module lets you require manager approval specifically for that field, in which case a staff edit is not saved at all — it is held as a before-and-after comparison, the record locks, and nothing changes until an approver accepts it.
Is the connection encrypted?
Yes, all traffic runs over encrypted connections, and the landlord portal is served as a self-contained document under a strict content security policy rather than through the main application theme.
Is our data encrypted, and do you take backups?
Yes to both. All traffic runs over encrypted connections, and automated backups run daily. Access is separated by role, posted journals cannot be edited or deleted, and every action is written to an audit log. If your procurement or audit process needs infrastructure specifics, ask and we will provide them in writing rather than publish them.
Ask the awkward questions
If your IT person or your auditor wants specifics, put them on the call. We would rather answer in detail than be vague.
Talk to us