# Security & Trust FAQ (v1.1)
_Prospect-facing. Be honest. Update as controls ship._  
_Source of truth for site “Security & trust” section and investor/sales decks._

## Company & product
**What is Leasing Loft?**  
An AI-assisted leasing desk that works in your email, with human approval controls, trained on your building’s voice and NYC-oriented policies — plus an immersive avatar/3D experience layer.

**Who hosts it?**  
Application on **Railway**; database on **Supabase (Postgres)**; email via **Google APIs**; LLM providers configurable (e.g. DeepSeek primary with OpenRouter/Gemini fallbacks).

## Data
**What data do you process?**  
Leasing inquiry emails, prospect contact info they submit, listing/availability data you connect, operator actions, reply logs, and operational logs needed to run the service.

**Do you train public models on our mail?**  
**Default: No.** We do not train third-party foundation models on Client content. Providers receive ephemeral inference API calls only. Anonymized product analytics only if the contract allows. Exact provider settings are documented per deploy.

**Who can see prospect PII?**  
Authorized Client operators + LL engineers bound to access policies during support. Service-role DB access is **server-side only**; the dashboard goes through app auth — the browser never holds database keys.

**Where does mail live?**  
Gmail remains the system of record. We process via OAuth with scoped access; we do not replace your Google Workspace tenancy.

## Access control
**How do operators log in?**  
Google OAuth against an **allowed-email allowlist** (and/or deploy-specific password patterns). Unauthorized Google accounts are rejected.

**Session hardening**  
Cookies: `httpOnly`, `sameSite=lax`, `secure` in production. TLS terminated at the host; app uses trust-proxy correctly on Railway.

**Is there a dev backdoor in production?**  
No. Dev auth bypass only when Google login is unconfigured **and** `NODE_ENV !== production`.

**Multi-tenant isolation?**  
Current early deployments prefer **dedicated infra per client** (separate Supabase project / deploy). Shared multi-tenant `org_id` is roadmap — ask for the current architecture note; we will not claim shared tenancy isolation we have not shipped.

## Application & platform security
| Control | Status |
|---|---|
| HTTPS / encrypted transit | **Yes** |
| Encryption at rest (vendor default) | **Yes** (Supabase / Railway) |
| Secrets in env / not in git | **Yes** (takeout + `.env` git-ignored) |
| Secret scan / SAST in CI (engine) | **Yes** |
| RLS forced, no public policies | **Yes** — service-role-only DB path |
| API auth on all `/api/*` | **Yes** (session required) |
| Claim-before-send on approvals | **Yes** (concurrency-safe) |
| Bot pause / stop kill switches | **Yes** |
| Audit-ish logs (reply_log, system_logs) | **Yes** |
| SOC 2 | **Not yet** — kickoff with revenue |
| Penetration test | Roadmap |
| DPA | Available on request (draft with counsel) |
| Subprocessors list | Provided on request |

## AI safety & fair housing
**Can the bot reject protected classes?**  
Designed to **escalate**, not auto-discriminate. Fair housing rules and human approval are core. Client remains responsible for compliant policies and final housing decisions.

**Human-in-the-loop?**  
Yes — approval mode recommended at go-live; Telegram + dashboard escalation for edge cases; tour confirms do not auto-create calendar events without review.

**Cost / model transparency**  
Token usage is tracked (per lead / day / month) so AI spend is visible to operators — not a black box bill.

## Reliability
**Uptime**  
Best-effort; depends on Google, LLM providers, and host. Health endpoint + “last checked” on the dashboard. Critical leasing paths should keep human fallback.

**Can we turn it off?**  
Yes — pause bot, full stop, disconnect OAuth, or revoke credentials immediately.

## How to evaluate us (for IT / ownership)
1. Request this FAQ + subprocessors list  
2. Review OAuth scopes (Gmail modify as required for send/label)  
3. Confirm allowlisted operators  
4. Walk Approval Queue + kill switches in a sandbox  
5. Optional: dedicated project isolation for first logos  

## Contact for security review
Shin Ochi · Shin@leasingloft.com  
Subject: Security questionnaire — [Company]

## Attachments for email
- **One-pager (Print → PDF):** [`../../Marketing_Materials/Sales/Leasing Loft - Security One-Pager.html`](../../Marketing_Materials/Sales/Leasing%20Loft%20-%20Security%20One-Pager.html)  
- Same file mirrored for agents: [`SECURITY-ONE-PAGER.html`](SECURITY-ONE-PAGER.html)