Data & Security

Soofair is early-access software run by a small team, and we would rather tell you plainly what we do than hide behind badges. We do not hold certifications such as SOC 2 or ISO 27001, and we have not yet commissioned a third-party penetration test. What follows are the security practices actually in place today.

All traffic between your browser and Soofair is served over HTTPS (TLS), enforced with HSTS and hardened security headers, so your data is encrypted on the wire.

Our database runs on Neon (Postgres, Singapore region), which encrypts stored data at rest.

Passwords are stored only as salted hashes using an industry-standard algorithm — we can never see or recover your plaintext password, which is why a reset, rather than a reminder, is the right recovery path.

Your session is a single signed token (JWT) held in a secure, HTTP-only cookie that JavaScript on the page cannot read.

Every request is checked against who you are. Landlords can reach only their own portfolio, tenants only their own unit, and brokers only their listings and referrals. These checks live in the data layer, not just the interface.

Infrastructure access follows least privilege: today, only the founder holds credentials to the hosting, database, and email providers.

If you believe you have found a security issue, please email hello@soofair.com with the details. We welcome good-faith reports and will work with you to confirm and resolve them.