Security at RentDocs

• Application hosted on Cloudflare's global edge network with automatic TLS.
• Database, authentication and file storage run on a UK/EU Supabase (PostgreSQL) region.
• Email delivery is handled by a managed provider with SPF, DKIM and DMARC on the notify subdomain.
• SMS delivery uses Twilio; UK sender identity configured.

• In transit: HTTPS/TLS 1.2+ across the site, the API, storage, and outbound integrations.
• At rest: database and object storage are encrypted at the platform layer.
• Passwords are hashed by the auth provider — never stored in plaintext. Password leak checks (Have I Been Pwned) are enforced at signup and reset.

Every landlord's data is isolated at the database layer using row-level security policies. A signed-in user can only read or write records they own; the server enforces this on every request, regardless of what the client sends. Admin operations are gated to a single named administrator, logged to an immutable audit table, and never exposed to end users.

Tenant document packs are shared through unique unguessable URLs (192-bit random tokens). We do this because tenants must be able to open their pack from a text message or email without creating an account. To keep those links safe:

• Each link is bound to a single tenant on a single property.
• Access is automatically revoked when the landlord archives that tenant (tenancy ends).
• Landlords can manually revoke all portal links for a property from the property page.
• Every open, download, and reply is written to a per-property access log the landlord can review (timestamp, IP, browser).
• Document downloads themselves use short-lived signed URLs (7-day expiry) issued on request, not permanent URLs.

• Payment card data is handled entirely by Paddle (our Merchant of Record). We never see or store card numbers.
• We do not sell personal data. See our Privacy Notice for the full list of subprocessors and legal bases.
• Tenancy records are retained for at least 6 years after the end of a tenancy for landlord compliance and dispute resolution.
• Account deletion is available on request via hello@rentdocs.co.uk.

The underlying database platform performs continuous backups with point-in-time recovery on our current plan. Object storage is replicated within the region. In a serious incident affecting user data, we will contact affected users by email without undue delay and, where applicable, notify the UK Information Commissioner's Office within statutory timelines.

If you believe you have found a security vulnerability in RentDocs, please tell us first — before any public disclosure — and we will work with you to fix it.

• Email: hello@rentdocs.co.uk with the subject line "Security".
• Please include steps to reproduce, the affected URL, and any proof-of-concept.
• Do not access, modify, or delete data belonging to other users; do not run automated scanners against production; do not perform denial-of-service testing.
• We aim to acknowledge reports within 2 working days and to keep researchers updated as we investigate.

RentDocs does not currently operate a paid bug-bounty programme, but we're happy to credit researchers on this page for good-faith reports.

RentDocs provides an in-house simple electronic signature capture with a tamper-evident audit certificate (signer name and email, IP address, user agent, timestamp, and a SHA-256 hash of the signed content). Under the Electronic Communications Act 2000 and the UK eIDAS Regulations, this is a valid simple electronic signature and is generally sufficient for residential tenancy agreements, guarantor deeds executed as a signed document, Legionella risk assessments and inventories. It is not a Qualified Electronic Signature (QES) or an Advanced Electronic Signature (AES) and should not be relied on where a specific contract type or counterparty requires QES/AES. RentDocs does not provide legal advice — if you are in doubt, take legal advice before signing.

RentDocs generates a domestic Legionella risk assessment from the landlord's answers, aligned with HSE ACOP L8 guidance for landlords of low-risk residential premises. This is a self-assessment tool for typical low-risk domestic settings — it does not replace an on-site survey by a competent risk assessor, and it is not appropriate for HMOs with cooling towers, spa/hot-tub systems, complex water systems, or premises where the tool flags "high" risk. In those cases you must engage a competent legionella risk assessor. The landlord remains responsible for compliance with the Health and Safety at Work etc. Act 1974 and the Control of Substances Hazardous to Health Regulations 2002.

RentDocs is a UK service and processes personal data in line with the UK GDPR and the Data Protection Act 2018. See our Data Processing Addendum and Subprocessors list. We are working towards additional independent certifications; we don't claim SOC 2, ISO 27001, or a completed penetration test at this time. When those are in place, this page will be updated with the date and scope.

Security questions or reports: hello@rentdocs.co.uk. General enquiries: rentdocs.co.uk/contact.