Security

How we look after your data.

This page says what Propli does today, in plain words. If something is not on this page, we are not claiming it.

Last reviewed 20 September 2026.

Accounts and access

  • Passwords are stored only as one-way hashes. Nobody at Propli can read your password.
  • Signed-in sessions use signed tokens.
  • People have a role: admin, landlord, property manager or viewer. Viewers can look but cannot change sales, buyer, lease, invoice, payment or maintenance records.
  • New accounts are by invitation while we are on the waitlist, and background jobs need a secret to run.

Keeping accounts apart

Each account sees only its own buildings, units, tenants, leases, invoices, buyers and documents. The data is looked up by account on the server, not just hidden on screen.

Your documents

  • Leases, statements, ID documents and other files that are not property photos are stored privately. Only the account that uploaded a file can open it, and a signed-out visitor gets nothing.
  • Property photos are stored publicly, because photos on a listing are meant to be seen by the public.
  • A photo that is marked as an ID, statement, lease, invoice, proof of payment or utility bill is treated as private, not as a listing photo.

Buyers and consent

  • A buyer is only added to a waiting list after they tick a consent box on an enquiry or offer.
  • A buyer can stop at any time. Once someone is marked as stopped, the server never puts them back and never messages them again.
  • Changes to a buyer’s status are written to an audit log that records what changed.

Incoming messages

Incoming WhatsApp messages are checked against a signature from WhatsApp. If the signature is missing or wrong, the message is ignored. WhatsApp is not switched on yet, and this check is built in for when it is.

Where it runs

Propli is hosted on Vercel over HTTPS. Records and files are stored with Supabase. Our privacy page lists every service that touches personal data.

What we do not claim

We do not hold a security certification, and we do not claim compliance we cannot show. We would rather tell you that than imply otherwise.

Known limits

  • There is no self-service tool yet to export or delete all of your data. Ask us and we will do it by hand.
  • Files are protected by who is signed in. We do not yet offer per-file sharing links with expiry.
  • We are a small team. Report a problem to [PRIVACY EMAIL ADDRESS] and we will look at it.