Security

Security is foundational to rentalEase. We handle sensitive financial data — rent amounts, tenant PAN numbers, GST details, and payment records — and we treat that responsibility with the seriousness it deserves. Our security practices are designed to protect your data at every layer.

• Firebase Authentication — Industry-standard email/password authentication with bcrypt-hashed credentials. We never see your password in plain text.
• Role-Based Access — Three roles (Admin, Editor, Viewer) with per-page access control enforced both in the UI and in Firestore security rules.
• Organisation Isolation — Every document is scoped to an organisation. A user in Org A can never access data belonging to Org B, enforced at the database level.
• Session Security — Firebase ID tokens are short-lived and refreshed automatically. Single-device session enforcement for first-login users.
• Login Alerts — Email notifications on every sign-in with timestamp, helping you detect unauthorised access.

• Encryption in Transit — All communication uses TLS 1.2+ encryption.
• Encryption at Rest — Google Cloud Firestore encrypts all data at rest using AES-256.
• Serverless API Functions — Vercel serverless functions with rate limiting per user and per IP. No persistent server state to compromise.
• No Private Keys in Client Code — Firebase Admin SDK private keys are stored only in serverless function environment variables, never in client-side code or Git.
• Input Validation — All API endpoints validate and sanitise inputs, with size caps on request bodies.

• Activity Logging — All data modifications are logged with user identity, timestamp, and summary — visible in the Admin activity log.
• Usage Logging — Page visits and login events are recorded for security analysis.
• Backup & Restore — Admins can export all data as JSON at any time and restore from a backup file.

• Authentication Required — All API calls require a valid Firebase ID token.
• Rate Limiting — Per-user and per-IP rate limits on email, chat, and admin endpoints.
• No Secrets in Git — .env files are gitignored. Private keys never leave the serverless environment.
• Super Admin Protection — Sensitive operations (user deletion, password reset) require Bearer token authentication with admin privileges.

If you discover a security vulnerability in rentalEase, please report it responsibly by emailing patelhet.0507@gmail.com. We will acknowledge your report within 48 hours and work with you to understand and address the issue.

We do not offer bug bounties at this time, but we deeply appreciate responsible disclosure and will credit researchers who help us improve our security.