Data & Security

Soofair is beta software run by a small team, and we would rather tell you plainly what we do than hide behind badges. We do not hold certifications such as SOC 2 or ISO 27001, and we have not yet commissioned a third-party penetration test. What follows are the security practices actually in place today.

Sign-in, sign-up, password-reset and enquiry forms are rate-limited. Changing your password signs out every older session. We do not yet offer two-factor authentication.

When Soofair staff change something on an account through our internal tool — resending a verification email, sending a password-reset link, changing an email address, suspending an account, lifting a suspension, deleting an account — the change is written to a record we do not go back and change. Simply opening an account to look at it is not a change, so it does not appear in that record.

What limits looking instead is that the tool has no directory of accounts to browse. There is no browsing and no partial-name search: it will not open an account until a member of staff types the full email address, or the account's own internal reference. One list does exist, and we would rather name it than let you assume otherwise — the list of people who have asked to join the beta, some of whom have since become customers. Their email addresses are masked on screen — you see the shape of an address, not the address — until a member of staff chooses to show them.

We intend to record staff reads as well, so that opening an account leaves the same permanent trail that changing one does. Until that is built, what is written above is what limits it.

All traffic between your browser and Soofair is served over HTTPS (TLS), enforced with HSTS and hardened security headers, so your data is encrypted on the wire.

This section names our database and file storage, and explains the backup work that still needs verification.

The database is Neon (Postgres, Singapore region). Neon states that it encrypts stored data at rest and offers recovery tools. We have not yet confirmed that we can recover your data using those tools.

Uploaded files and images — leases, receipts, photos, signatures — live in a private Vercel Blob store. No file is ever served from that storage host: everything is delivered through Soofair's own routes, so the underlying storage address never reaches a browser. Private documents and images check who you are on each individual request. There are two deliberate exceptions, and both are pictures that are meant to be seen. Photos on a published marketplace listing are public by publication — anyone can view a listing, so anyone can view its photos — but only through a route scoped to that published listing, never by a storage address. The founder's portrait on our homepage is the other: it is our own picture rather than a customer's, and the route that serves it takes no input at all, so it can never return anything else. We have not independently confirmed the storage provider's at-rest encryption, so we do not claim it here.

Cloudflare R2 is the destination for our file backups. We have not yet confirmed that backups can recover your data. Any existing backup copies are restricted to recovery or security use.

The backup design uses TLS for transfers and relies on Cloudflare-managed storage encryption. It does not use client-side, end-to-end or zero-knowledge encryption, so we do not claim that only Soofair can read them.

Passwords are stored only as salted hashes using an industry-standard algorithm. The password itself travels over an encrypted connection and is processed only transiently to create or check the hash — it is never stored, and it cannot be recovered from the hash, which is why a reset, rather than a reminder, is the right recovery path.

Your session is a single signed token (JWT) held in a secure, HTTP-only cookie that JavaScript on the page cannot read.

Every request is checked against who you are. Landlords can reach only their own portfolio, tenants only their own tenancy, and brokers only their listings and referrals. These checks live in the data layer, not just the interface.

Today only the founder holds credentials to the hosting, database and email providers.

If you believe you have found a security issue, please email hello@soofair.com with the details. We welcome good-faith reports and will work with you to confirm and resolve them.