Security

Your leads and customers are safe with us – here is exactly how

We are a young company, so we will not ask you to trust a badge. This page lists what the software does to protect your data, in plain language, and what we do not have yet.

Ask a security question

Your company’s data is isolated

Many companies use PropMother CRM on the same platform. Your records are separated from everyone else’s at three independent levels.

Every record belonging to a company carries that company’s identifier, and the application refuses any query that does not name one.
The database itself enforces row-level security: a connection working for one company cannot read another company’s rows, even if the application made a mistake.
The application runs under a restricted database role that cannot bypass those rules.
Automated tests try to read one company’s data from another on every release.

People see only what they should

Access is decided on the server for every request – hiding a button is never the only protection.

Roles control what a person can do; you can edit them or create your own.
Data scopes control which records they see: their own, their team’s, their branch’s or all, set separately for leads, contacts, properties and more.
Phone numbers can be masked for chosen roles, and revealing private data is recorded.
Exporting data is a separate permission, and exports can be watermarked.
Nobody can give another person more access than they hold themselves.

Sign-in is protected

Most breaches begin with a stolen password. We make a password alone insufficient.

Passwords are stored only as Argon2id hashes; we cannot read them and neither can anyone else.
Two-step sign-in with an authenticator app, with recovery codes.
Accounts lock after repeated failed attempts, and sign-in attempts are rate-limited.
You can see and end your active sessions, and changing a password signs out other devices.
A password policy rejects short, common and personal passwords.

Sensitive values are encrypted

Some information needs more than access control.

Connections to the service use HTTPS.
Integration credentials, authenticator secrets and bank details are encrypted at rest with AES-256-GCM.
Reset links and one-time codes are stored only as hashes.
Uploaded files are checked before they are accepted.

Everything important leaves a trail

When something goes wrong, you need to know who did what and when.

Sign-ins, permission changes, exports, deletions and access to private data are written to an audit log.
Administrators can search the log and export it; exporting it is itself recorded.
Records are soft-deleted, so an accidental deletion can be traced.

Our own staff are restricted too

Supporting you should not mean free access to your data.

Our staff console is a separate system with its own sign-in; two-step sign-in is mandatory for every staff member.
Staff cannot browse your leads or contacts. To help you inside your workspace they must start a time-limited support session, give a written reason and re-confirm their identity.
Every such session is recorded and is visible in your own audit log.
Staff never see or set your users’ passwords – they can only send a reset link.

Privacy tools for your customers’ data

India’s Digital Personal Data Protection Act makes you responsible for the personal data you hold. The product helps you meet that responsibility.

Record consent and its withdrawal for each contact, and respect opt-outs per channel.
Log and track access, correction and erasure requests with due dates.
Set retention periods.
Export your organisation’s data, and delete your workspace when you leave.

Security questions, answered straight

Where is my data stored?

In a PostgreSQL database and file storage operated for PropMother CRM. Ask us for the current hosting region and providers before you sign – we will tell you exactly, in writing.

Do you have ISO 27001 or SOC 2 certification?

Not at present. We would rather say so plainly than imply it. This page describes the controls the product actually has; if you need a security questionnaire answered, we will complete it.

Can I get my data out?

Yes. Lists export to CSV for users with the export permission, and an administrator can export the organisation’s data.

What happens to my data if I cancel?

After the subscription ends there is a grace period, then the workspace becomes read-only before it is closed. Deleted workspaces are kept for a retention period, then removed. You can ask for deletion sooner.

How do I report a security problem?

Contact us through the contact page and mark the message as a security report. We acknowledge reports and will keep you informed while we investigate.

See it with your own leads and inventory

A 30-minute walkthrough with someone who knows real estate. We set up your workspace and help with your first import.

Book a demo See pricing

Free trial on every plan
Priced per company, not per user
Your data stays yours