Your data, on your rules.
What protects your account, your tenants and your money today, written down plainly. Where we have not done something yet, this page says so.
What is in place. Checked against the product.
Signing in
- Every page and API call travels over HTTPS.
- Passwords are stored as scrypt hashes, never as text.
- Two-step verification with a one-time code at sign-in.
- Sign in with Google or Apple instead of a password if your team prefers.
Who sees what
- Roles decide what each person can view, create, edit or delete.
- Access can be limited to the properties a person works on.
- Every request is checked against the signed-in user's role, on the server.
- Records show who created them and who changed them last.
Money
- Card and bank details are entered with Stripe and stay with Stripe; TenantLoop never stores them.
- Rent is paid out to your own Stripe account, not held in ours.
- Bank connections go through Plaid; we never see your bank login.
Your data
- Export lists and reports whenever you like and keep your own copy.
- Remove a person's access in one click when they leave.
- API keys act with the permissions of the person who made them, need a fresh two-step check to view and can be revoked at any time. A connected Claude can read and add tasks, notes and prospects, never move money or delete.
Agents get the same rules.
Not looser ones.
Inside your rules
Agents work with the permissions you give them and the policies you write.
Every step on the record
Each action is logged and attributed in the activity log.
A person where you want one
Choose the steps that wait for approval: opening a work order, picking a vendor, a bill, a renewal offer.
What we do not claim yet
No SOC 2 or ISO certificate, no public status page and no uptime figure. We will add each one here when it is real, with a link you can check.
Security questions. Plain answers.
Do you have SOC 2 or another certification?
Not yet. We would rather say so than show a badge we do not hold. When we complete an audit, this page will name it and link the report.
Can a teammate see everything?
Only if you allow it. Roles control each area of TenantLoop separately, and access can be limited to certain properties. A leasing agent can work with prospects and tenants without seeing financial reports.
What can the AI agents see and do?
The same records your rules allow, nothing more. You choose which steps they may take alone and which wait for a person, and every action is written to the activity log with who or what did it.
Where do tenants' card details go?
Straight to Stripe, which processes the payment. TenantLoop receives a confirmation and the amount, never the card number or bank login.
How do I get my data out?
Export buttons on lists and reports give you files you can open in a spreadsheet. If you close your account, write to us and we will help you take everything with you.
I think I found a security issue.
Please write to us with the details and steps to reproduce. Do not include tenant data. We will reply to you directly.
See the controls for yourself.
14 days free, card up front, cancel in one click.