Data & Security

Soofair is beta software run by a small team, and we would rather tell you plainly what we do than hide behind badges. We do not hold certifications such as SOC 2 or ISO 27001, and we have not yet commissioned a third-party penetration test. What follows are the security practices actually in place today.

Sign-in, sign-up, password-reset and enquiry forms are rate-limited. Changing your password signs out every older session. We do not yet offer two-factor authentication.

When Soofair staff change something on an account through our internal tool — resending a verification email, sending a password-reset link, changing an email address, suspending an account, lifting a suspension, deleting an account — the change is written to a record we do not go back and change. Simply opening an account to look at it is not a change, so it does not appear in that record.

What limits looking instead is that the tool has no directory of accounts to browse. There is no browsing and no partial-name search: it will not open an account until a member of staff types the full email address, or the account's own internal reference. One list does exist, and we would rather name it than let you assume otherwise — the list of people who have asked to join the beta, some of whom have since become customers. Their email addresses are masked on screen — you see the shape of an address, not the address — until a member of staff chooses to show them.

We intend to record staff reads as well, so that opening an account leaves the same permanent trail that changing one does. Until that is built, what is written above is what limits it.

All traffic between your browser and Soofair is served over HTTPS (TLS), enforced with HSTS and hardened security headers, so your data is encrypted on the wire.

Your records live in three places, and this section names all of them rather than only the easy one.

The database is Neon (Postgres, Singapore region). Neon states that it encrypts stored data at rest. It is protected by Neon's own daily snapshots and history window; we do not yet keep a copy of the database with a second provider, and we will update this page when we do.

Uploaded files and images — leases, receipts, photos, signatures — live in a private Vercel Blob store. No file is ever served from that storage host: everything is delivered through Soofair's own routes, so the underlying storage address never reaches a browser. Private documents and images check who you are on each individual request. There are two deliberate exceptions, and both are pictures that are meant to be seen. Photos on a published marketplace listing are public by publication — anyone can view a listing, so anyone can view its photos — but only through a route scoped to that published listing, never by a storage address. The founder's portrait on our homepage is the other: it is our own picture rather than a customer's, and the route that serves it takes no input at all, so it can never return anything else. We have not independently confirmed the storage provider's at-rest encryption, so we do not claim it here.

Off-site backups of those files are held in a private Cloudflare R2 bucket, encrypted at rest by Cloudflare using AES-256 with Cloudflare-managed keys, with every transfer protected by TLS. The keys are Cloudflare's, not ours: we do not use client-side, end-to-end or zero-knowledge encryption for backups, so we do not claim that only Soofair can read them.

Passwords are stored only as salted hashes using an industry-standard algorithm. The password itself travels over an encrypted connection and is processed only transiently to create or check the hash — it is never stored, and it cannot be recovered from the hash, which is why a reset, rather than a reminder, is the right recovery path.

Your session is a single signed token (JWT) held in a secure, HTTP-only cookie that JavaScript on the page cannot read.

Every request is checked against who you are. Landlords can reach only their own portfolio, tenants only their own tenancy, and brokers only their listings and referrals. These checks live in the data layer, not just the interface.

Today only the founder holds credentials to the hosting, database and email providers; the nightly backups run under separate credentials that can only read or only write.

If you believe you have found a security issue, please email hello@soofair.com with the details. We welcome good-faith reports and will work with you to confirm and resolve them.