Security

1. Access Control

• Every account has a role: seller, agent, coordinator, team lead, brokerage admin or super admin.
• Who can see each home is checked by rules in the database on every request, not only hidden on screen.
• Sellers see only their own home. Private staff notes and internal questions are never shown to sellers.
• Buyer's agents and open house hosts use private, single-purpose links that show only their own appointment or report. Changing a host makes the old host's link stop working.

2. Sign-In

• Staff sign in with a password. Sellers sign in with a one-time email link.
• Passwords are handled by our sign-in provider and are never stored by us in readable form.
• Invitation links expire and can be used only once.

3. Entry Codes

• Lockbox and door codes are visible only to staff on the listing, never to sellers.
• A code is sent to a buyer's agent only after their showing is confirmed, and only to that agent.
• Agents can change or clear a code at any time.

4. Protecting Data

• All traffic to the app uses encrypted connections (HTTPS).
• Data is stored with our hosting provider, which encrypts stored data and keeps backups.
• Keys for outside services are kept on the server and never sent to the browser.
• Deleted listings are hidden immediately and only a super admin can restore or permanently remove them.

5. People and Providers

• Only a small number of our team can reach production systems, and only to support the service.
• When we view an account to help with support, that access is logged.
• We choose service providers carefully and give them only the information their job needs. They are listed in our Privacy Policy.

6. Monitoring and Incidents

We watch for errors and unusual activity and run automated security checks on the app. If we learn of a breach that affects your personal information, we will investigate, contain it and notify affected people and authorities as the law requires.

7. What You Can Do

• Use a strong password you do not use elsewhere, and do not forward sign-in links.
• Remove people from a listing or team when they no longer need access.
• Share entry codes only through the app rather than in open group texts.

8. Report a Concern

If you think you found a security problem, Email us with details. Please give us a chance to fix it before sharing it publicly. We will not take action against good-faith research that avoids harming users or their data.