Security Practices

Tenanting is committed to protecting the confidentiality, integrity, and availability of information processed on the Tenanting platform. This page outlines the security practices and controls implemented to safeguard personal data, platform systems, and user activity — for property owners, tenants, and NRI owners managing properties remotely.

These practices are designed in alignment with applicable Indian laws, including the Digital Personal Data Protection Act, 2023 (DPDP Act), and follow generally accepted industry standards for handling sensitive identity documents such as Aadhaar.

1. Security by Design

Security is integrated into the design and development of the Tenanting platform, not added after the fact. Controls are implemented at multiple layers — application, infrastructure, and data — to reduce risk and limit the impact of potential threats.

2. Access Control

• Role-based access controls restrict data access based on user role — owner, collaborator (viewer/editor/admin), or tenant
• Session-based authentication protects user accounts, with session regeneration enforced at every login, OTP verification, and password reset to prevent session fixation
• Tenant onboarding OTPs are hashed using bcrypt before storage — plaintext OTPs are never persisted
• Administrative access to platform-wide controls is restricted to authorized personnel through a dedicated super-admin gate, separate from regular owner/collaborator access
• Invite tokens used for collaborator and tenant onboarding links are single-use, time-limited, and expire automatically (7-day expiry for tenant invites)

3. Data Encryption

Tenanting applies encryption to protect data both in transit and at rest, with stronger controls for the most sensitive categories of data.

• All traffic between your browser and the Tenanting platform is encrypted using TLS
• Documents uploaded to the platform — agreements, KYC proofs, receipts — are stored in encrypted cloud storage, with encryption keys managed separately from the data itself, so access to storage alone does not expose readable documents
• Aadhaar numbers and other sensitive identifiers are stored encrypted and displayed in masked form after verification (e.g. XXXX XXXX 1234) — full numbers are never shown in the owner dashboard
• Document downloads are served through short-lived, signed access links rather than permanent public URLs, so files are not directly accessible without authorization

4. Infrastructure Security

Platform infrastructure is protected through layered controls designed to prevent unauthorized access and service disruption.

• Cloud infrastructure credentials are scoped separately by function — for example, storage access keys are kept distinct from email-sending credentials — so a compromise of one does not automatically expose the other
• Firewall and network security configurations restrict access to backend systems and databases
• Application components are isolated where appropriate to limit the blast radius of any single point of failure
• Infrastructure and dependencies are monitored for abnormal or suspicious activity

5. Application Security

The Tenanting application is developed using secure coding practices to reduce vulnerabilities at the source.

• Cross-Site Request Forgery (CSRF) protection is enforced on every form submission across the platform
• All output is escaped before being rendered, and structured input validation is applied to every form submission to reduce the risk of injection-based attacks
• Every property route validates that the requesting user is actually authorized for that specific property before returning data — access checks are not based on URL guessing
• Controlled use of third-party libraries and services, with credentials and integrations reviewed before being added to the platform

6. Data Minimization & Purpose Limitation

Personal data collected on the Platform is limited to what is necessary for defined and lawful purposes — primarily tenant identity verification, lease management, and rent tracking. Tenant KYC data is collected with explicit consent captured during the onboarding flow, and is used only for the verified purpose of that specific tenancy.

Access to personal data is restricted to the minimum required to perform platform functions — a collaborator with viewer access, for instance, cannot access the same data as the property owner.

7. Monitoring & Logging

Tenanting maintains system logs and monitoring mechanisms to:

• Detect unauthorized access attempts
• Identify operational issues affecting platform availability
• Maintain an audit trail of settings changes, with before/after snapshots, to support transparency and dispute resolution between owners and tenants
• Support audit and compliance requirements, including document access logging (who accessed or downloaded a given document, and when)

8. Incident Management

Security incidents are handled through defined internal procedures aimed at containment, assessment, and remediation.

Where required by law, including under the DPDP Act, affected users and relevant authorities may be notified of data breaches affecting their personal data, within the applicable statutory timelines.

9. Third-Party Security

Tenanting integrates with a limited set of third-party service providers for specific functions — cloud storage and infrastructure hosting, email delivery, WhatsApp-based notifications, payment processing, and AI-assisted document generation. Reasonable steps are taken to ensure such providers implement appropriate security measures, and data shared with them is limited to what is necessary for the function being performed.

10. User Responsibilities

Users play an important role in maintaining security. Users are responsible for:

• Keeping login credentials and OTPs confidential, and never sharing them — including with anyone claiming to represent Tenanting
• Using a strong, unique password for their Tenanting account
• Verifying that property invite links and onboarding links were received from a source they trust before submitting personal documents
• Reporting suspicious activity, unexpected access requests, or suspected phishing attempts promptly using the contact details below

11. Continuous Improvement

Tenanting regularly reviews and improves its security practices to address evolving threats, technology changes, and regulatory requirements, including periodic review of access controls, dependency updates, and platform configuration as the product evolves.

12. Responsible Disclosure

If you believe you have discovered a security vulnerability in the Tenanting platform, we encourage you to report it to us responsibly rather than disclosing it publicly. We request that you:

• Provide enough detail for us to reproduce and assess the issue (steps, affected URL/feature, and impact)
• Avoid accessing, modifying, or deleting data that does not belong to you while investigating an issue
• Give us a reasonable opportunity to investigate and remediate before any public disclosure

We do not currently operate a paid bug bounty program, but we do acknowledge and credit valid, responsibly disclosed reports.

13. Contact for Security Concerns

Security-related concerns or vulnerability reports may be shared with Tenanting at:

Email: security@tenanting.in

Last updated: August 2026