Security & Trust
One-pager for ownership, IT, and broker partners · Confidential
Leasing Loft is an AI leasing desk that runs inside your Gmail workflow. Inboxes hold prospect PII and operator judgment — so we build for narrow access, a locked-down database, human gates, and honest compliance (no fake SOC 2 logos).
1. Who can get in
- Google OAuth + allowed-email allowlist
- Every API route requires a server session
- Dev auth bypass is off in production
- Unauthorized Google accounts are rejected
2. Session hardening
- Cookies: httpOnly, sameSite=lax
- Secure flag in production
- HTTPS / TLS at the host (Railway)
- App uses correct trust-proxy for TLS
3. Database lockdown
- Supabase Postgres
- RLS forced — no public policies
- Service-role only on the server
- Browser never holds database keys
4. Secrets & code
- Keys only in host environment variables
- Mail exports & .env are git-ignored
- Engine CI: secret scan + SAST gates
- No secrets committed to GitHub
5. Human-in-the-loop
- Approval Queue for edge drafts
- Pause / full-stop kill switches
- Per-lead silence + Telegram alerts
- Claim-before-send (no double-sends)
6. AI & fair housing
- No training foundation models on your mail (default)
- Ephemeral inference API calls only
- Protected-class paths escalate
- You remain landlord of record
Control checklist
| Control | Status |
|---|---|
| HTTPS / encrypted transit | Yes |
| Encryption at rest (vendor default) | Yes |
| Allowlist auth + session cookies | Yes |
| RLS + service-role-only data path | Yes |
| Secrets out of git + CI secret gate | Yes |
| Reply log / system log audit trail | Yes |
| Bot pause / stop / revoke OAuth anytime | Yes |
| SOC 2 Type II | Roadmap |
| Independent pen-test | Roadmap |
| Formal DPA (counsel) | On request |
Isolation & data scope
What we process: inquiry email, prospect-submitted contacts, listings/availability you connect, operator actions, operational logs.
Where mail lives: Gmail stays system of record. OAuth-scoped access — we don’t replace your Workspace tenancy.
Early clients: dedicated deploy + database project available. Shared multi-tenant org isolation is roadmap — we won’t claim it before it ships.
Subprocessors: Railway, Supabase, Google, LLM providers (configurable). Full list on request.