Security & Trust

• Email & password sign-in with leaked-password protection (checked against the Have I Been Pwned database).
• Google single sign-on supported.
• Role-based access control (agent, manager, principal, admin). Roles are stored in a dedicated user_roles table and enforced via a security-definer helper — never client-editable.
• Every authenticated request is scoped to the signed-in user via Row-Level Security policies at the database.

• Data in transit is encrypted with TLS 1.2+ across all endpoints.
• Data at rest is encrypted by our managed Postgres provider (AES-256).
• Passwords are hashed by Supabase Auth (bcrypt-family). PropIQ never sees plaintext passwords.
• Payment card data is handled entirely by Paddle, our Merchant of Record — PropIQ never stores card numbers.

• Row-Level Security is enabled on every user-facing table with explicit policies.
• Automated daily backups are retained by our infrastructure provider.
• Users can export their own data at any time (Settings → Account).
• Account deletion removes personal data within 30 days of confirmation.

PropIQ shares operational data with the following processors so we can deliver the service:

• Supabase — managed Postgres, authentication, storage (EU/US regions).
• Paddle — Merchant of Record for subscriptions, tax, and invoicing.
• Google Maps Platform — address autocomplete for the property intake wizard.
• Cloudflare — edge network, DNS, DDoS protection.
• Lovable — hosting for the application runtime.

A current list is available in the Privacy Notice.

• Webhook endpoints verify HMAC signatures and enforce idempotency via an event ledger.
• Server-side entitlement checks gate all PropIQ Capital features — client-side hiding is never the sole gate.
• Security-scanner findings are reviewed on each release. Critical findings block publish.
• Cookie consent respects an explicit opt-in for analytics; essential cookies only by default.

If you believe you have found a security vulnerability, please email security@propiq.app. We aim to acknowledge reports within 2 business days. Please do not publicly disclose the issue until we have had a reasonable chance to address it.