Security & data protection
Your records are the business. We treat them that way.
HomeDash holds tenancy agreements, certificates, rent histories, and personal details — the evidence trail your rental business runs on. This page describes, specifically and without marketing gloss, how that data is protected. Last reviewed 25 September 2026.
Encryption, both directions
All traffic between your browser and HomeDash is encrypted with TLS. Your records and uploaded documents are stored in the UK (London), on a managed database platform that encrypts everything at rest with AES-256.
Your data is isolated to your account
Every record belongs to one landlord account. Our servers identify your account from your signed-in session and scope every request to it, and row-level security is enabled on every database table as a second layer. Team members only see what their role allows; a tenant only sees their own tenancy, and only while it is live.
Hardened sign-in
Passwords are hashed with an industry-standard algorithm and never stored or logged in plain text. Sign-in, password reset, and invitations are rate-limited; new accounts must pass Cloudflare Turnstile bot verification and password complexity requirements. Every sign-in, successful or failed, is recorded. We never email you a password.
Card details never touch our servers
Payments are handled entirely by Stripe, a certified PCI Service Provider Level 1. We store a billing reference — never card numbers.
Real deletion, on request
Deleting your account starts a 30-day window in which you can change your mind. After that we delete it properly: your database records, uploaded files, sign-in identity, and payment-provider customer record. Encrypted copies inside our disaster-recovery backups are kept for recovery purposes only.
Backed up independently, every night
On top of our database host's own daily backups, we take a nightly copy of the database, uploaded documents, and signed agreements, encrypt it with AES-256, and store it in two places, one of them off-site with a separate provider. Restores are rehearsed, not assumed.
Responsible disclosure
Found a vulnerability? Email support@homedash.co.uk and we will respond promptly. We ask for reasonable time to fix before public disclosure, and we will credit you if you want that.
Who processes your data
We keep the list of companies that touch your data short, and we name them. We never sell your data and never take commissions or referral kickbacks — HomeDash is funded by subscriptions alone.
Supabase
Database, authentication, and file storage
Vercel
Hosting for this website
Hostinger
Hosting for the HomeDash application
Stripe
Subscription payments
Resend
Transactional email (receipts, notices, account emails)
Brevo
Marketing email — only for contacts who opted in (double opt-in)
Anthropic
AI features — processes the questions you ask, and the records or documents needed to answer them
Cloudflare
Bot protection on signup (Turnstile)
Analytics on this website (consent-gated), and calendar/document integrations you connect
Meta (WhatsApp Business)
WhatsApp notifications, where enabled
Google Workspace
Our support email inbox — whatever you send to support@homedash.co.uk
getAddress.io
Address lookup when you enter a UK address
postcodes.io
Postcode lookup (only the postcode is sent)
Backblaze
Off-site storage for our disaster-recovery backups (encrypted before upload)
Accountability
HomeDash is a product of Wessex Investment Services Ltd (Company No. 10402782), registered with the UK Information Commissioner's Office (ZB298208). Data protection questions: support@homedash.co.uk. The full picture of what we collect and why is in the Privacy Policy; how we research and publish is in our Editorial Standards.