Plain words about how we protect your data.
Leases, rent rolls and ledgers are some of the most sensitive records a property business keeps. This page says exactly what we do today, and just as plainly what we haven't done yet.
Security at a glance
Your data, walled off
Every record carries your organization's id, and the database itself refuses rows that aren't yours (row-level security on every table).
Encrypted
Encrypted in transit between you and us, and at rest in the database and file storage. Files open through short-lived signed links.
People approve
Nothing is sent, posted, filed or paid without a person. Every change lands in an audit trail with a name and a time.
AI that doesn't learn from you
The AI providers we use do not train their models on your data. They get only what a task needs.
One database, walls in every table.
Many customers share the same infrastructure, the way tenants share a building. Row-level security is the wall between suites: the database itself hands each session only its own organization's rows. Enterprise customers can have a building of their own.
One table in the database: leases
- ATidepool Coffee Co.Brisa Point Coffee Pad
- BHarbor Coffee RoastersWrenfield CommonsRefused
- ASteadfast Tire & AutoCalloway Auto Service Center
- BFresh Harvest MarketWrenfield CommonsRefused
- ASeacliff Family DentistrySeacliff Dental Building
- BBlue Fern YogaWrenfield CommonsRefused
Policy: org_id = your organization
What your session receives
- ATidepool Coffee Co.Brisa Point Coffee Pad
- ASteadfast Tire & AutoCalloway Auto Service Center
- ASeacliff Family DentistrySeacliff Dental Building
The other customer's rows are filtered out by the database itself, before the app sees anything.
What we do today.
Each customer's data is kept apart by the database
Every organization is a separate tenant. Every business record carries its organization's id, and Postgres row-level security filters every query the app makes, so a request in one organization cannot read or change another's rows even if the application code had a bug.
- Row-level security is enabled on every table that holds customer data, with a policy on each one
- The app connects through a database role that cannot bypass row-level security
- Links between records are checked to belong to the same organization, so a record can't point at another customer's
- Automated tests try cross-organization reads and writes on every table and fail the build if any succeed
Portals show people only their own records
Tenants and owner clients sign in to portals that read through a separate path. Each portal view returns a fixed list of fields, filtered to that person's own leases, charges, statements or properties.
- Portal users are refused every staff page and staff API
- Staff notes and purchase records never reach a portal
- A portal user who isn't linked to a contact sees nothing
Encrypted in transit and at rest
Connections to the service are encrypted with TLS. Data is encrypted at rest in the database and in file storage, and uploaded documents open through short-lived signed links.
- Strict transport security in production
- Files stored per organization, checked for type and size
- Signed links expire; there are no public file URLs
Backed up, and kept in the United States
Customer data is stored in the United States. The database can be restored to any second of the last 35 days, and daily and monthly backups are copied to a second US region. Enterprise customers get a private, dedicated environment with its own database, keys and backups.
- Point-in-time recovery for the last 35 days
- Daily backups kept 35 days and monthly backups kept a year, in two regions
- Backups are protected from deletion
- Earlier versions of every file are kept for 90 days
Sign-in and access
Accounts sign in with a verified email and password, a one-time code or link, or Google or Apple where enabled. Two-step sign-in with an authenticator app is available, and when it's on, every sign-in method requires it.
- Roles: owner, admin, manager, accountant, viewer, and two portal roles
- Rate limits on sign-in and on AI features
- Membership is checked on every request, for the web, the iPhone app and the API
People approve, and everything is recorded
The AI drafts; people decide. Nothing is sent to a tenant, posted to the books, filed or paid without a person approving it, and every change is written to an audit trail with who made it and when.
- Approvals carry the person's name and the date
- Closed accounting periods lock
- Books post only balanced entries
AI that works for you, and only you
The AI providers we use process data under terms that do not allow them to train their models on it. We send each one only what a task needs, and we list them on the subprocessors page.
- Lease answers quote the lease, and quotes are checked against the PDF's own text
- Two readers from different AI companies, so one model's mistake is caught by the other
- The ChatGPT and Claude connector signs in with your account and reads only what your role can see
Built carefully
A strict content security policy with a fresh nonce on every page, security headers, validated input on every form and API call, and dependency audits.
- Uploads are type-checked and size-capped
- No secrets in the browser
- Integrations stay hidden until they are configured
No badges we haven't earned.
Cornerhold is in founding access. We'd rather tell you where we are than borrow words that sound reassuring.
No SOC 2 report or other certification yet.
We have not completed a SOC 2 audit or any security certification. When we do, this page will say so, with the date and the report available on request.
No independent penetration test yet.
Our own reviews and automated tests run on every change. An outside firm's test is planned before general availability.
No uptime commitment yet.
During founding access there is no service level agreement. Automated checks watch the service around the clock, and incidents are posted on the status page.
Found something? Tell us first.
If you believe you've found a security issue, write to us with the details. We'll confirm we received it, keep you updated, and won't take action against good-faith research that respects people's data.
Help us draw the first set.
We are opening the product to a small group of owners and firms first. You get a guided import with our team and a direct line to the people building it. Pricing isn't set yet; we'll talk it through with you before you pay anything.