We understand that as a property management platform, we handle sensitive tenant, owner, and financial data, and security is our highest priority.
Last updated: November 6, 2025
Table of contents
Security Philosophy
At DoorSpot, we believe security is not a feature—it's a foundation. Our platform is built with security-first principles:
Defense in Depth: Multiple layers of security controls protect your data
Zero Trust Architecture: Every request is authenticated and authorized
Least Privilege Access: Users have only the permissions they need
Continuous Monitoring: Real-time tracking of security events and anomalies
Regular Updates: Ongoing security improvements and vulnerability remediation
Authentication & Access Control
Secure Authentication
JWT-Based Authentication
Industry-standard JSON Web Tokens (JWT) with industry-standard signing algorithms
Unique signing keys per user for enhanced security
Short-lived access tokens that are automatically refreshed
Secure token transmission via HTTPS-only connections
Multi-Factor Authentication (2FA)
Optional Google Authenticator integration for time-based one-time passwords (TOTP)
Numerous recovery backup codes for account recovery
Temporary authentication tokens for 2FA verification
Industry-standard authentication flow
Password Security
Bcrypt password hashing with industry-standard cost factors
No password storage in plaintext
Secure password reset flow with time-limited tokens
Password validation on all authentication attempts
Granular Access Control
Role-Based Access Control (RBAC)
Multiple distinct user roles with varying permission levels
Permission gates for fine-grained authorization
Emergency access procedures with full audit trail
Role validation on every request
Multi-Tenancy & Data Isolation
Strict data isolation ensuring complete organizational data separation
User context switching with full audit trails
Comprehensive data boundary protections
Session Management
Limited-duration refresh tokens
IP address and user-agent validation on token refresh
Automatic token rotation on renewal
Session revocation on logout
Data Encryption & Protection
Encryption Standards
Data in Transit
TLS 1.2+ encryption for all API communications
HTTPS-only connections (no unencrypted HTTP)
Secure WebSocket connections for real-time features
Certificate pinning for API clients
Data at Rest
AES-256 encryption for application-level secrets
Bcrypt password hashing for user credentials
Field-level encryption for sensitive PII
Encrypted database backups
Cookie Security
Secure cookie configuration with CSRF protection
HttpOnly and Secure flags enforced
Production-grade cookie hardening
Sensitive Data Handling
Protected Information
User credentials: Securely hashed, never logged
Authentication secrets: Encrypted with per-user keys
Financial identifiers: Field-level encryption
Payment methods: Fully tokenized via PCI-DSS Level 1 provider
API Response Protection
Sensitive fields are never exposed in API responses, including authentication secrets, payment details, and internal identifiers.
API Security & Rate Limiting
Request Protection
Rate Limiting
Rate limiting enforced on all endpoints with dynamic throttling based on usage patterns
IP-based throttling for unauthenticated requests
Automatic retry-after headers for rate limit responses
CORS Policy
Strict origin whitelist
Credentials support for authenticated requests
Exposed headers limited to operational requirements
Input Validation
Comprehensive request validation on all endpoints
Type coercion and format validation
Array and nested structure validation
SQL injection prevention via parameterized queries
String trimming and sanitization
Middleware Security Stack
Layered Protection
JWT token validation on every API request
Automatic token refresh in response headers
CSRF protection for session-based endpoints
Proxy trust configuration for accurate IP logging
Request/response logging for security monitoring
Specialized middleware for privileged operations and error tracking
Audit Logging & Monitoring
Comprehensive Audit Trail
What We Log
Comprehensive audit coverage across all critical data models
User authentication events (login, logout, failed attempts)
Permission and role changes
Financial transactions
Sensitive operations
API requests with IP address, user agent, and URL
Audit Details
Every audit record captures:
Who: User ID and associated person/contact
What: Event type and human-readable description
When: Precise timestamp
Where: IP address and geographic context
How: User agent (browser/device information)
Before/After: Old and new values for all changes
Retention & Access
Database audit logs retained indefinitely
File-based logs retained in accordance with our data retention policy
Audit detail reconstruction for compliance reporting
Journey tracking for individual contacts and companies
Real-Time Monitoring
Error Tracking & Alerting
Real-time error monitoring and alerting
Automated notifications for critical errors
Automatic exception reporting with stack traces
Performance monitoring for database queries and API calls
Security Event Monitoring
Failed authentication attempt tracking
Unusual access pattern detection
Payment processing error alerts
Third-party integration failure notifications
Third-Party Integrations
We carefully select and integrate with industry-leading service providers to enhance our platform while maintaining security:
Payment Processing
Stripe (PCI-DSS Level 1 Service Provider)
Payment card tokenization (no card data stored by DoorSpot)
Bank account verification
ACH and credit card payment processing
Webhook signature verification
Connect platform for owner payouts
Plaid (SOC 2 Type II Certified)
Bank account linking and verification
Transaction history syncing
Secure credential exchange
Communications
Twilio (SOC 2 Type II Certified)
SMS messaging and delivery tracking
Phone number verification
Message status tracking
SendGrid / Mailgun
Transactional email delivery
Email tracking and analytics
Bounce and spam handling
Background Screening
TransUnion
Rental history verification
Credit and background checks
Tenant screening reports
Compliance with Fair Credit Reporting Act (FCRA)
Security Measures for Integrations
API Key Management: All credentials stored in environment variables
Webhook Verification: Cryptographic signature validation for all webhooks
Rate Limiting: Throttling on all webhook endpoints
Error Handling: Comprehensive logging of integration failures
Data Minimization: Only necessary data shared with third parties
Compliance & Certifications
Industry Standards
Payment Card Industry Data Security Standard (PCI-DSS)
Level 1 compliance via Stripe partnership
No card data stored on DoorSpot servers
Tokenized payment methods
Annual compliance validation
Data Privacy Regulations
GDPR Compliance (General Data Protection Regulation)
Lawful basis for data processing
User consent management
Data portability capabilities
Right to access personal data
CCPA Compliance (California Consumer Privacy Act)
Privacy policy disclosure
Data collection transparency
Consumer rights respect (access, deletion, opt-out)
Security Best Practices
Soft Deletes: Preserves data integrity while allowing restoration
Audit Trails: Complete history of all data modifications
Data Minimization: Collect only necessary information
Purpose Limitation: Data used only for stated purposes
Access Controls: Role-based permissions and least privilege
Data Privacy & Retention
What Data We Collect
User Information
Email addresses (for authentication and communication)
Names and contact details
Password hashes (bcrypt, never plaintext)
Login timestamps and IP addresses
Property Management Data
Property and unit details
Tenant and owner information
Lease agreements and terms
Rental application data
Financial Data
Invoice and payment records
Bank account tokens (via Plaid)
Payment card tokens (via Stripe)
Transaction history
How We Protect Your Data
Access Controls
Multi-factor authentication for privileged accounts
Role-based access control
Client-based data isolation
IP address logging
Data Retention
Financial records: Retained per legal and regulatory requirements
Audit logs: Retained indefinitely for compliance
Application logs: Retained in accordance with our data retention policy
Soft-deleted data: Restorable until permanently purged
Data Deletion
User-initiated account deletion supported
Cascade deletion of associated records
Audit trail preservation for compliance
GDPR right-to-be-forgotten processes
Data Sharing
We never sell your data to third parties. Data is shared only with:
Service providers necessary for platform operation (see Third-Party Integrations)
Legal authorities when required by law
Your authorized users within your organization
Incident Response
Our Commitment
In the unlikely event of a security incident:
Detection: Real-time monitoring and alerting systems
Containment: Immediate isolation of affected systems
Investigation: Forensic analysis to determine scope and impact
Notification: Timely communication to affected users
Remediation: Fixes and enhanced controls to prevent recurrence
Review: Post-incident analysis and security improvements
User Notification
Affected users notified within 72 hours of discovery
Clear communication about incident scope and impact
Recommended actions for affected users
Updates throughout investigation and remediation
Continuous Improvement
Regular security audits and penetration testing
Vulnerability scanning and patching
Security training for development team
Third-party security assessments
Contact & Security Reporting
Report Security Vulnerabilities
If you discover a security vulnerability, please report it responsibly:
Email: [email protected] (monitored 24/7)
Scope: DoorSpot API, web application, mobile apps
Response Time: Acknowledgment within 24 hours
What to Include
Detailed description of the vulnerability
Steps to reproduce
Potential impact assessment
Your contact information (for follow-up)
Our Commitment
We will not pursue legal action against good-faith security researchers
We will acknowledge your contribution (with your permission)
We will provide updates on remediation progress
We may offer bug bounty rewards for significant findings
Security Questions
For general security questions or concerns:
Support Email: [email protected]
Documentation: https://docs.doorspot.com
Status Page: https://status.doorspot.com
Security Roadmap
We continuously evaluate and enhance our security posture through regular assessments, industry best practice adoption, and proactive security improvements.
Conclusion
Your trust is our most valuable asset. We are committed to maintaining the highest security standards to protect your data and privacy. This document is regularly updated to reflect our current security practices.
For the most up-to-date information, please visit our security page or contact our security team.
Thank you for trusting DoorSpot with your property management needs.
This document was last reviewed on November 6, 2025. For questions or concerns, please contact [email protected].