Data Protection & Security

1. Controls observed in the current code

Operational providers are in memory, with fictional sample records. No operational private-file upload or payment service is connected. Browser evidence capture requires user action and is local-only; source checks do not certify evidence. Review feedback is local and has no unconfigured submission endpoint.

Editorial server functions validate an authentication token and editor permission. Three editorial/role tables have row-level security policies. Server-function CSRF protection and client token attachment are installed. These controls protect the narrow editorial surface, not the public demo workspaces. The audit found table-grant and trigger-function execution issues requiring staging remediation; RLS alone does not prove successful or secure end-to-end access.

2. Not yet implemented or independently verified

Real landlord/tenant/contractor memberships, cross-account isolation, private documents, signed access, deletion jobs, malware scanning, durable audit, secure invitations and owner MFA administration are not established in this main preview. No penetration-test result, certification, encryption configuration, geographic hosting assurance or legal-compliance certification is claimed.

Authentication tokens can persist in browser storage. Error hooks may forward messages/stacks; sensitive-content redaction and production log handling require review. Device hashes/timestamps do not prove when evidence was captured or provide tamper-proof storage. The main preview shares the live Cloud backend; new account work belongs only in the separate isolated staging draft.

3. Incident handling and reporting

Use Contact to report a suspected issue with a short description, time and affected page. Do not send passwords, access tokens, exploit dumps containing tenant data or private documents. Do not probe other users’ accounts. A formal security response channel and response commitments require confirmation.

Before launch, incident triage, access revocation, evidence preservation, processor notification and controller assessment must be documented. Where required, a controller notifies the ICO within 72 hours of becoming aware of a personal-data breach and explains delays; high-risk affected individuals must be informed without undue delay. Processors notify the controller without undue delay. These are legal responsibilities to assess, not an implemented automated alert process.

4. Privacy by design

Do not collect real operational data until security gates pass. Use the minimum information necessary, narrowly scoped roles and short-lived access. Future analytics should be aggregate and exclude message/document content and unnecessary addresses. Optional marketing consent must be separate and withdrawn independently of essential account notices. See the Privacy Policy and DPA draft for unresolved assessments.