Your data, locked down
Property and contact data is a competitive advantage for you and a liability if it leaks. Encryption, SOC 2 infrastructure, SSO, granular roles, and full audit logs are the foundation here — not an upsell.
Institutional-grade controls, by default
Encryption everywhere
TLS 1.2+ in transit, AES-256 at rest — the same standard on every part of the platform.
SOC 2 Type II infrastructure
Hosted on certified infrastructure with continuous control monitoring.
Granular permissions
Admin, Contributor, and Viewer roles keep sensitive deal data scoped to who needs it.
Audit logs
Every access and change in enterprise workspaces is recorded — and exportable.
SSO & SCIM
SAML single sign-on and directory provisioning so access follows your HR system.
Backups & recovery
Encrypted, geographically redundant backups with tested restore procedures.
Encrypted at every stage
Records are encrypted in transit and at rest, keys live in a dedicated management service, and one tenant can never reach another's data.
In transit
All traffic over TLS 1.2+ with modern cipher suites; HSTS enforced.
At rest
AES-256 on databases, object storage, and backups.
Key management
Keys managed in a dedicated KMS with regular rotation; no keys in application code.
Isolation
Tenant data is logically separated and access-scoped at every layer of the stack.
Only the right people, only what they need
Permissions are enforced server-side on every request. Add MFA, drive access from your identity provider, and cut a session the instant you need to.
Role-based access
Predefined and custom roles; permissions checked on every request, not just the UI.
MFA
TOTP and WebAuthn/passkeys available for every account; enforceable org-wide.
Session controls
Configurable session length and idle timeout; revoke a session instantly.
Least privilege
Internal access to production is limited, logged, and reviewed on a schedule.
Tested, reviewed, and prepared
Penetration testing
Independent third-party tests at least annually; findings tracked to closure.
Vendor review
Sub-processors are assessed before onboarding and bound by data-protection terms.
Incident response
A documented plan with defined severities, on-call rotation, and customer-notification commitments.
Responsible disclosure
Report a vulnerability to security@propleak.io — we acknowledge quickly and don't pursue good-faith research.
What your admins control
Security FAQ
In SOC 2-certified data centers in the United States, with geographically redundant backups. Enterprise customers can discuss region requirements.
Talk to our security team
Questions about compliance, our SOC 2 report, a DPA, or enterprise deployment?