Trust
Security & Compliance
Last updated: September 24, 2026
Proppely, Inc. · Hollywood, FL
Proppely holds rent ledgers, lease documents, association records, resident personal information, and — when a user connects Gmail or Outlook — copies of that mailbox. This page describes the controls that protect it, in specific terms rather than reassurances. Where a certification belongs to one of our providers rather than to us, we say so. If your security team needs something not covered here, write to us through our contact page. Google user data practices are also in Privacy — Google User Data.
1. Infrastructure & Independent Audits
Where Proppely runs
Proppely runs on Render (application and database), Vercel (website and web application hosting), and Amazon Web Services (document storage, email delivery, and media). The application, database, and document storage are located in the United States; Vercel delivers web traffic through its global edge network. We do not operate our own data centers.
Our providers’ audits
Render maintains a SOC 2 Type 2 attestation and ISO/IEC 27001 certification, and Amazon Web Services maintains SOC 1, SOC 2, SOC 3, ISO 27001, and PCI DSS Level 1 attestations. Render’s SOC 3 report is available on request. These are our providers’ audits, not ours.
Our own programme
Our security programme is documented rather than improvised. We maintain a written policy set covering access control, change management, incident response, and business continuity; a risk register that is scored and reviewed on a defined cadence; and control objectives describing how we process our customers’ financial transactions. We are working toward a SOC 2 examination, a SOC 1 examination, and ISO/IEC 27001 certification. We will name the firm and the report date here once an engagement is signed — an intention is not an audit, and we would rather you could check what we tell you.
What we can share
For security reviews we can provide our infrastructure providers’ publicly distributable reports, our subprocessor list, and a written description of our PCI DSS scope.
2. Payment Data & PCI DSS
Residents’ and applicants’ payment details never reach our systems
This is the most important fact about our security posture. When a resident or applicant pays, card numbers, security codes, and full bank account numbers are entered directly into our payment provider’s own hosted form, which runs in an isolated frame served from the provider’s domain. That data is transmitted to the provider and never passes through, and is never stored on, Proppely infrastructure. We receive only a payment token plus the card brand and last four digits.
Our PCI scope
Because all cardholder data functions are fully outsourced to a PCI DSS Level 1 validated provider, Proppely falls within the scope of PCI DSS Self-Assessment Questionnaire A — the shortest assessment, available to merchants who handle no cardholder data themselves. We do not describe ourselves as “PCI certified” or “PCI compliant”: SAQ A is a self-assessment, not a certification, and the meaningful fact is the one above — the data never reaches us.
Payment page integrity
The pages that host the payment frame carry a Content Security Policy that restricts executable scripts to an explicit allowlist of payment and mapping vendors. Analytics, tag managers, session replay, and advertising scripts are prohibited on the payment path, and adding a host to that allowlist is treated as a compliance change rather than a routine deployment.
No rent payments through chat
Rent cannot be paid through chat, and payment details are never entered in a chat channel. When our assistant (in the app, in Proppely Desktop, or in a linked chat) or a connected AI agent prepares an action that moves money, it can only propose it: nothing runs until an authorized user in your organization approves it, in Proppely or with a deliberate tap in a linked chat, and electronic payouts need approval from two different people.
3. Encryption & Secrets
In transit
All traffic between your browser or mobile app and our servers is encrypted using TLS 1.2 or higher. HTTP requests are redirected to HTTPS.
At rest
Data at rest — including the database, uploaded documents, and backups — is encrypted with AES-256 by our infrastructure providers.
Application-layer encryption for sensitive fields
Certain fields carry a second layer of encryption above the storage layer, including rental application identifiers and third-party integration credentials. Encryption keys are held as secrets in our hosting environment’s configuration, separate from the database.
Connected mailbox tokens
Gmail and Outlook OAuth access and refresh tokens are encrypted at the application layer with AES-256-GCM before they are stored, in addition to the infrastructure encryption of the database at rest. We store imported message copies on our US-hosted database so /inbox can work when Gmail is not open. We do not copy Gmail attachments into object storage.
Passwords
Account passwords are hashed with Argon2, a memory-hard algorithm designed to resist offline cracking. Plaintext passwords are never stored or logged.
4. Access Control & Data Separation
Separation between organizations
Proppely is a multi-tenant platform. Every request is authenticated and bound to a single organization, and data access is scoped to that organization at the data-access layer so that one organization’s records cannot be returned to another. This scoping is enforced centrally rather than re-implemented per feature.
Roles inside your organization
Members hold explicit roles that determine what they can see and do. Each organization has a single account owner with supreme authority who cannot be removed by other members. Residents, owners, and vendors access their own portals and can never reach organization-wide data.
Connected Gmail and Outlook
A connected mailbox is bound to the user who authorized it. Teammates cannot open another user’s Gmail or Outlook copies. Owners, managers, and agents may connect their own accounts; tenants cannot. Unlink at Settings → Integrations → Email revokes the provider token and deletes that user’s Proppely copies. Native organization mail delivered through Amazon SES is a separate shared inbox and is not erased by unlinking Gmail.
Two-factor authentication
Accounts support time-based one-time password (TOTP) two-factor authentication with recovery codes. Sensitive authentication flows, including sign-in links, remain subject to the second factor.
Audit logging
Security-relevant and financially significant actions are recorded to an append-only audit log with the acting user, organization, timestamp, and affected record.
5. Data Retention & Deletion
You own your data
Records you enter remain yours. Financial reports, ledgers, documents, and rent rolls can be exported at any time in standard formats so that leaving Proppely never means losing your history.
Statutory retention for community associations
Florida community associations must keep official records for periods fixed by statute — generally seven years under Fla. Stat. §§ 718.111(12) and 720.303(4), with certain records required to be kept permanently. Proppely is built so that association records subject to those requirements are retained rather than aged out, and so that owner record requests can be satisfied from the platform.
Deletion
You may request deletion of your account and associated personal data at proppely.com/account-deletion. Unlinking a connected Gmail or Outlook mailbox deletes Proppely’s copies of that mailbox and revokes the OAuth token; mail inside Gmail or Outlook is unchanged. Deleting your Proppely login also disconnects those mailboxes. We may retain records where law requires it — tax and financial transaction records, and association official records within their statutory window — or where retention is necessary for fraud prevention. We will tell you what is retained and why.
6. AI Features & Your Data
Your data is not used to train models
Proppely does not use customer data to train machine learning models, and does not permit our model providers to do so. AI features send only the context needed to answer the request at hand. Connected Gmail and Outlook text may be sent as capped excerpts, with the sender and matched-contact details from your records, through OpenRouter solely to produce an inbox category, tags, a one-line gist, and a suggested follow-up action with details from the message filled into a form you review. Nothing is created or sent until a person saves it. We do not use that mail for advertising.
Restricted Gmail scopes
When Google requires a Cloud Application Security Assessment (CASA) for restricted Gmail scopes, we complete it with an authorized lab. We do not describe ourselves as CASA-validated until a lab has issued a Letter of Validation for this application.
Actions that move money stay under human control
AI features can read your data and draft work, but actions that move money require explicit human approval before they take effect. Record changes proposed in the in-app assistant and in linked chats wait for your confirmation. Proppely Desktop and connected AI agents can make ordinary record changes directly, including ones that send a standard notification such as assigning a vendor to a work order, unless your organization turns on approval for those too. Every tool the assistant can reach is classified by risk before it is enabled, and unclassified tools are denied by default.
7. Availability & Recovery
Backups
The production database is backed up automatically. Documents are stored in versioned, redundant object storage.
Logging and monitoring
Application errors are recorded in structured application logs retained by our hosting providers, and those providers monitor the health of their own platforms.
8. Reporting a Vulnerability
How to reach us
If you believe you have found a security vulnerability in Proppely, report it through the contact form at proppely.com/contact with enough detail to reproduce it. We will acknowledge your report and keep you informed as we investigate. We ask that you give us a reasonable opportunity to remediate before public disclosure, and we will not pursue action against good-faith research that respects user privacy and avoids service disruption.
Incident notification
If a security incident affects your data, we will notify you without unreasonable delay and describe what happened, what data was involved, and what we are doing about it, consistent with applicable breach-notification law including Fla. Stat. § 501.171.
9. Subprocessors
These vendors process customer data on our behalf. Some are engaged only when you enable the corresponding feature.
| Vendor | Purpose | Data | Region |
|---|---|---|---|
| Render | Application and database hosting | All platform data | United States |
| Vercel | Website and web application hosting; relays browser requests to the application | Website and application request traffic | Global edge network |
| Amazon Web Services | Document storage, email delivery, document text extraction, meeting media | Documents, email content, meeting recordings | United States |
| Moov Financial | Payment processing and payouts | Payment credentials, transaction data | United States |
| Payment processing partners | Owner distributions and screening fee processing | Payment credentials, transaction data | United States |
| Plaid | Bank account verification and transaction sync | Bank account and transaction data | United States |
| Checkr | Tenant background screening | Applicant identity and screening data | United States |
| TransUnion SmartMove | Tenant credit and background screening | Applicant identity and screening data | United States |
| DocuSign | Electronic signature (optional integration) | Documents sent for signature | United States |
| Sure | Renters insurance offering | Resident contact and policy data | United States |
| TaxBandits | 1099 preparation and filing | Vendor and owner tax identifiers | United States |
| Twilio | SMS account notifications (opt-in) and leasing phone numbers | Phone number, message and call content | United States |
| Meta WhatsApp Cloud API | WhatsApp messaging channel (opt-in) | Phone number, message content | United States |
| Telegram | Telegram messaging channel (opt-in) | Telegram account identifier, message content | Global |
| Expo | Mobile app push notifications | Device push token, notification content | Global |
| Lob | Printing and mailing checks and letters | Mailing addresses, check and letter contents, and the bank details printed on checks | United States |
| Gmail API (optional Connect Gmail) | Authorized mailbox messages and send-as-user | United States | |
| Microsoft | Outlook mail through Microsoft Graph (optional Connect Outlook) | Authorized mailbox messages and send-as-user | Where your account is hosted |
| Intuit QuickBooks | Accounting integration (optional) | Company name and chart of accounts, used to map your Proppely accounts to QuickBooks | Where your account is hosted |
| Aircall | Caller context and call records (optional integration) | Caller phone numbers, call details, and the resident, rent status, and work order context shown to your agents | Where your account is hosted |
| MaintainX | Work order sync (optional integration) | Maintenance requests, work orders, and property locations | Where your account is hosted |
| OpenRouter | Routes AI inference, including inbox triage | Prompts and message excerpts | United States |
| Anthropic, OpenAI, DeepSeek, and other model providers | AI assistant, document understanding, and inbox classification | Context supplied to the request | United States |
| Mapbox | Maps and geocoding | Property addresses | United States |