RentRoll · by Streetwise Software Online · SWSO
Security
Your financial records deserve care. This page describes the protections built into RentRoll today. We only list measures that are actually in the software.
Your account
- Passwords are stored only as salted one-way hashes made with PHP's password_hash function; nobody can read your password, including us. Passwords must be at least 8 characters.
- Repeated failed sign-ins are slowed down: after 5 failed attempts for the same email from the same network address, or 20 from one network address, within 15 minutes, sign-in is paused for 15 minutes.
- Your session ID is replaced every time you sign in, and the session cookie is HttpOnly and SameSite=Lax, and marked Secure when the site is served over HTTPS.
- Every form and data change requires a secret anti-forgery (CSRF) token.
Your data stays yours
- Every record is tied to its owner, and every read or change checks that it belongs to the signed-in user, so one customer can never open another customer's data.
- All database queries use prepared statements, which prevents SQL injection, and everything shown on screen is escaped to prevent cross-site scripting.
- The database sits in a private folder that the web server refuses to serve.
- Spreadsheet exports are protected against formula injection.
- Bank routing and account numbers you enter are used only to fill in your own export files and are never shown to anyone else.
The browser side
- A strict Content Security Policy only allows scripts and styles from RentRoll itself, and pages cannot be framed by other sites.
- No third-party trackers, analytics, advertising or font services are loaded.
Payments
Card payments are handled entirely by Stripe on Stripe's secure checkout. Card numbers never reach our servers. Messages from Stripe to RentRoll are accepted only when their cryptographic signature checks out and is less than five minutes old.
What you can do
- Use a long password you do not use anywhere else, and sign out on shared computers.
- Export a backup of your data from time to time.
- Tell us straight away if you notice anything unusual on your account.
What we do not claim
RentRoll does not yet offer two-factor sign-in, and we do not currently hold third-party security certifications such as SOC 2 or ISO 27001. We will update this page if that changes.
Reporting a security problem
If you believe you have found a vulnerability, please email [support email] with the details and give us a reasonable time to fix it before telling anyone else. Please do not access other people's data or disrupt the Service while testing.