Security

1. Security Approach

DoorRent uses layered security controls designed to protect account access, payment flows, internal operations, and customer data across web, API, and mobile surfaces.

2. Account Protection

• Authenticated landlord, tenant, caretaker, and internal operations sessions.
• Password hashing, one-time codes, and time-limited magic-link workflows.
• Role-scoped access controls across protected product areas.
• Biometric unlock on supported mobile experiences.
• Workspace-aware login controls for branded subdomains and scoped access surfaces.
• Session invalidation when accounts are deleted.

3. Operational Controls

We use logging, request validation, access checks, and dependency-managed services to reduce abuse, unauthorised access, and avoidable data exposure. Access to production tooling is limited to authorised personnel who require it to operate the service.

Sensitive processor credentials and reusable billing authorisations are stored using application-level protection controls and are not exposed through public product flows.

4. Third-Party Providers

DoorRent relies on carefully selected providers for infrastructure, email, and payment processing. Those providers maintain their own security and compliance programs, and we use them only for the portions of the workflow they are intended to support.

Some workflows may also depend on third-party meeting, messaging, push-notification, or payment services. Their availability and security posture remain subject to their own policies and platform controls.

5. Incident Response

If we become aware of a security incident that materially affects DoorRent data or service integrity, we will investigate, contain, remediate, and notify affected parties when required by law or where we determine notice is appropriate.

6. Responsible Disclosure

If you discover a potential vulnerability, please report it privately to support@doorrent.com with enough detail for us to reproduce and assess the issue. Please do not exploit the issue, access data you do not own, or disrupt the service.