This page describes the security and data-handling controls DoorSpan implements today. It is an honest overview of how the product is built — not a certification, audit report, or guarantee. DoorSpan is in an invite-only beta; some controls below are configured per deployment, and the final published version of this page is pending counsel review.
Tenancy isolation
DoorSpan is multi-tenant. Every database query is scoped by an organization id, and the app is written so one organization cannot read or write another's records. Isolation is enforced in the data layer, not by hiding parts of the screen.
Access control & authentication
Access is role-based and enforced on the server for every action — hiding a control in the UI is never the gate. Roles are least-privilege: an Owner has full administrative access, Operations manages day-to-day work, and a Bookkeeper sees finances but no tenant personal information. Sessions are database-backed httpOnly cookies, passwords are hashed with bcrypt, and the Owner account supports two-factor authentication.
Data in transit & at rest
All traffic is served over HTTPS. Records and uploaded files are stored with our hosting and storage providers (listed on the Subprocessors page), whose managed platforms encrypt data at rest. DoorSpan does not run its own servers or disks.
How AI is used
- AI behaviour depends on this deployment's configuration — see the privacy page for what applies here.
- Legal and tax output is decision support only; no housing decision is automated.
- Widening AI use requires a separate provider review, data-flow review, synthetic rehearsal, and explicit activation approval.
- Usage telemetry carries opaque organization and user ids only — never names, emails, or message content.
Consent & audit trail
Communication consent (email, SMS, calls) and legal-agreement acceptance are recorded in an append-only consent ledger that fails closed. Significant actions are written to a per-organization audit log, so there is a record of who did what and when.
Retention & deletion
The maintenance beta accepts only approved maintenance evidence. A retention schedule must be configured from counsel-approved policy before retained files are accepted. Unknown or unscheduled sensitive classes are blocked for quarantine review. Deletion remains subject to legal holds, shared-file references, provider confirmation, and the verified disposal workflow.
Your data rights
- Access, correction, export, and deletion requests require identity and authority verification.
- The maintenance beta does not promise immediate self-service deletion of every record or provider copy.
- Deletion may be limited by legal holds, shared-file references, backup lifecycle, and verified provider disposal.
- A finalized privacy contact and request/appeal workflow are required before Production activation.
Subprocessors
The third-party services that may process data are listed, with their purpose and release status, on the Subprocessors page. A listing there is not evidence a provider is enabled or receives data.
Reporting a concern
Security questions and vulnerability reports will route to a published security contact. That contact and a formal disclosure process are being finalized before general availability.