Security by default.

You can supply your own OpenAI API key. It is stored using AES-256-GCM symmetric encryption with a 256-bit key derived from your environment. The encryption key never leaves the server, and we cannot decrypt your API key — only the runtime can. The encrypted ciphertext is stored in MongoDB and never returned to the client.

All database queries on tenanted models (properties, knowledge base sections, guest requests, assets) are automatically scoped to the requesting organization via a Mongoose plugin that injects the organizationId filter at the ORM level. No cross-tenant data access is possible through normal application flows.

All traffic is encrypted in transit. The application enforces HTTP Strict Transport Security (HSTS) with a max-age of 31,536,000 seconds (one year), including subdomains, with preload eligibility.

Every response includes: X-Frame-Options: DENY (clickjacking prevention), X-Content-Type-Options: nosniff, X-XSS-Protection: 1; mode=block, Referrer-Policy: strict-origin-when-cross-origin, and Permissions-Policy restricting camera, microphone (self only), and geolocation.

Files are stored in a private AWS S3 bucket. Guest images are served via presigned URLs with a 1-hour TTL — the bucket itself is never publicly accessible. Database connections use the official MongoDB driver over TLS.

Payments are handled entirely by Stripe. Card details never touch our servers. Stripe webhook events are verified by signature before processing. Processed webhook event IDs are stored to prevent replay attacks.

Authentication uses Auth.js v5 with Google OAuth only. No passwords are stored. JWT tokens carry the minimum necessary claims. Sessions expire on browser close by default.