Your records. Your trust.
Security & Trust
Reviewed November 4, 2026
Your Property Passport contains information worth protecting. Here is how PremisePulse protects access, uses service providers and prepares for recovery—and where those protections have limits.
This security overview complements our Privacy Policy, which explains data handling, retention and your choices.
How we protect your information
Protected connections and account access
The website uses HTTPS. Private records require sign-in and account-based permissions. Property sharing and chore permissions have separate boundaries; a chore invitation does not grant access to Passport photos. Supabase describes encryption at rest and in transit for its hosted customer data.
Private files and owner-controlled sharing
Saved photos and receipts use private storage with authorized, short-lived access links. A link already issued may remain usable until it expires; removing access does not recall copies someone already downloaded. Authorized operators and service providers may access information as needed to run the service and handle support.
Encrypted recovery copies
Separate customer database and stored-file recovery copies are encrypted locally before upload to private backup storage. The daily backup workflow checks encrypted data and restores files to compare checksums. Isolated database and scoped application recovery have also been rehearsed; these checks do not prove every future recovery or production cutover will succeed.
Checks and administrative safeguards
We run scheduled regression, dependency and privacy-consistency checks, with security checks on selected source changes. Reviewed administrative accounts use multi-factor authentication. These are periodic checks, not continuous monitoring or a guarantee that every issue is detected.
The providers behind PremisePulse
Providers receive information needed for their role. Their links describe their own practices; listing a provider does not mean every feature is enabled or that records are shared with every provider.
| Provider | Role and information | When used |
|---|---|---|
| SupabaseSecurity — Supabase | Account sign-in, database and private file storage Account/authentication details, saved property records, photos and receipts | Core service |
| VercelSecurity — Vercel | Website hosting and server requests Requests, necessary service data and technical/security logs | Core service |
| OpenAIAPI data practices — OpenAI | Optional AI photo observations The photo, selected category and concern submitted for analysis | When you choose an enabled AI analysis |
| ResendPrivacy — Resend | Account and enabled reminder email delivery Recipient and message content needed for delivery | Account mail; reminders only where enabled |
| Google Gmail / WorkspaceWorkspace security — Google Gmail / Workspace | Privacy-contact and business support mail Sender details, email content and attachments you choose to send | When you contact us by email |
| Backblaze B2Privacy — Backblaze B2 | Separate private recovery storage Locally encrypted recovery files and storage metadata | Approved recovery-copy workflow |
| StripePrivacy — Stripe | Prepared hosted checkout and existing payment records Billing/order identifiers and information entered at checkout | New purchases are currently paused |
| ExpoPrivacy — Expo | Phone test builds and distribution Build and tester/device information needed for approved testing | Phone testing; public app-store release is separate |
| RevenueCatPrivacy — RevenueCat | Prepared phone subscription testing Test account and simulated entitlement/purchase information | Enabled Staging tests only; no production purchasing |
| Zippopotam.us, MET Norway and U.S. National Weather ServiceWeather details in our policy — Zippopotam.us, MET Norway and U.S. National Weather Service | Optional postal-area weather and alert lookups Saved ZIP/postal area and approximate coordinates; no phone GPS or photos | When supported location/weather tools are used |
| Better Business BureauPrivacy — Better Business Bureau | External repair-business search Prepared repair category and search location | Only when you choose to open a BBB search |
| GitHubPrivacy — GitHub | Source hosting and development security checks Source code, workflow results and development metadata | Development workflow; not a destination for customer record exports |
| Cloudflare TurnstileTurnstile Privacy Addendum — Cloudflare Turnstile | Bot verification for authentication screens when enabled. IP address, TLS fingerprint, user agent, site key and origin; short-lived verification token. The check receives no property records or account password from PremisePulse. | Prepared in Staging; production activation waits for website and iPhone checks. |
Clear about our limits
This overview describes reviewed controls. PremisePulse does not claim its own SOC 2 or ISO certification. A provider’s certification, available feature or enterprise offering does not establish that PremisePulse has the same certification or every optional control enabled.
Encryption is not a promise of end-to-end encryption or zero operator access. Information is processed by the services needed to provide the features you use. Provider logs and retention follow the applicable provider practices.
Our target for separate customer recovery copies is a rolling 30-day history. Provider cleanup is separate and may take longer. Account removal does not immediately erase older backups or provider logs; completed deletions must be reconciled before a real recovery.
Recovery tests have limits: managed service configuration, all administrator attributes, replacement-device recovery and production cutover are not fully reproduced by a database archive. Actual aged backup cleanup has not yet been observed.
No system is risk-free. We do not sell personal information or use advertising trackers in the current website and app. Avoid putting unnecessary sensitive information in photos, notes or support messages.
Questions or a security concern?
Email support@premisepulse.com. Describe what you observed and how to reproduce it without sending passwords, access tokens or other people’s records. Our published privacy contact remains available in the Privacy Policy.