Trust Center

Last updated: May 11, 2026

HomeRelay handles property, tenant, and vendor data on behalf of independent landlords. This page is the single source of truth for the security, privacy, and automation-disclosure controls we maintain. We publish only claims we can back with a code test, anything still in the roadmap appears at the bottom of this page, never in the present tense.

Security controls

Data in transit encrypted via TLS

All HTTPS traffic to homerelay.app runs over TLS, terminated by the platform. All outbound webhook traffic (Stripe, Twilio, SendGrid, OpenAI, Anthropic) is HTTPS-only.

Data at rest encrypted (Neon + AWS S3)

Our PostgreSQL database (Neon) uses provider-managed encryption at rest. Photos and document attachments in AWS S3 are encrypted with AES-256 server-side encryption.

Tenant PII encrypted at the application layer

Tenant names and email addresses are encrypted application-side with AES-256-GCM before being written to the database, disk-level encryption is a second layer, not the only layer.

All authenticated sessions rotate on login

In production, identity and session tokens are issued and automatically rotated by our auth provider (Clerk): a login establishes a fresh session, and the server derives a real account's identity only from the provider's verified session, never from a reusable cookie, so a pre-set session cannot be inherited (session-fixation prevention). The only cookie-based path is the isolated, synthetic demo sandbox, which carries no real account or customer data.

Per-session CSRF token with rotation after every mutation

Every authenticated session carries a 30-minute CSRF token (constant-time compare). After each state-changing request the server issues a fresh token via the `X-New-CSRF-Token` response header.

HTTP security headers (CSP, HSTS, X-Frame-Options, etc.) enforced

Per-request CSP nonce, X-Frame-Options DENY, X-Content-Type-Options nosniff, Referrer-Policy `strict-origin-when-cross-origin`, Permissions-Policy denying camera/mic/geo, and production-gated HSTS `max-age=31536000; includeSubDomains`.

File upload MIME validation via magic-byte enforcement

Uploads pass through a canonical magic-byte + MIME validator with a per-category allowlist (invoice / receipt / lease doc / photo). Video containers additionally run an ISO BMFF box-size sanity check.

Vulnerability disclosure with 5-business-day acknowledgement

Reports to security@homerelay.app are acknowledged within 48 hours and triaged within 5 business days. We will not pursue legal action against good-faith research that respects user privacy.

Confirmed data breaches disclosed within 72 hours

If we confirm a breach affecting your data we will notify you within 72 hours, matching the strictest state breach-notification baseline (e.g., CA 1798.82, NY SHIELD §899-aa).

AI and automation disclosures

Outbound automated SMS is labeled in-channel

Every dispatch SMS HomeRelay sends to a vendor or tenant is prefixed with [Automated message from HomeRelay's AI on behalf of {landlord name}]. The disclosure lives at the point of interaction, there is no separate marketing page that softens it.

Outbound automated voice calls are labeled up front

Every dispatch voice call HomeRelay places to a vendor opens with the same disclosure: it is HomeRelay's AI assistant calling on behalf of the named landlord. The call says so before anything else.

AI-generated content reaching end users is labeled

AI-generated replies in the tenant portal include disclosure language identifying them as an automated response.

Protected-class attributes redacted from vendor communications

Before any maintenance message goes to a vendor, HomeRelay strips federal fair-housing protected-class framing (race, color, religion, national origin, sex, familial status, disability) from the message. We do not generate rental listing copy.

Privacy

We do not sell personal information

HomeRelay has no data-broker integrations, no advertising-network pixels (Google Ads, Meta, TikTok), and does not engage in cross-context behavioral advertising. Any product analytics we run is opt-in via environment configuration and is never resold.

Sub-processors disclosed inline

Every third-party service that processes customer data (AWS, Stripe, Twilio, SendGrid, OpenAI, Anthropic, Fly.io, Neon, and others) is named in our Privacy Policy. The list is updated when a new integration ships.

Global Privacy Control (GPC) signal acknowledged

Browsers that send Sec-GPC: 1 are flagged at the server boundary; we respond with X-GPC-Honored: 1. The signal is a no-op today because we do not sell personal information, but the gate is in place if that ever changes.

Data access and deletion requests honored

Email privacy@homerelay.app to request a copy of your data or to delete your account. We verify identity and respond within 45 days (CCPA-aligned).

TCPA and SMS controls

STOP / HELP / START keywords honored across all SMS

Replying STOP opts a phone number out of all future automated SMS from HomeRelay. HELP returns a canonical help message. START re-opts in. Enforcement is centralized so every send path checks the same opt-out state.

Per-state quiet hours enforced for non-emergency SMS

Non-emergency dispatch SMS is gated to local 8 AM – 9 PM, with state-specific tightening where the law requires it (FL 8 PM cutoff). Emergency classification is the only bypass and is logged.

TCPA consent log retained for 5 years

Every consent grant, opt-out event, and emergency override is logged with a 5-year retention horizon. This exceeds the FCC §64.1200(d) 4-year floor and the FL FTSA 4-year statute-of-limitations window.

Toll-free SMS sender verification approved

Our SMS sender identity is a Twilio toll-free number whose verification for "Property Management / Maintenance Dispatch" messaging was approved in July 2026, with explicit STOP/HELP handling and the quiet-hours policy described above. Verified toll-free sending is the carrier registration path for toll-free numbers; A2P 10DLC campaign registration applies to local 10-digit numbers, which we do not send from.

Landlord SMS consent collected at signup

Landlords opt in to receive HomeRelay SMS notifications at SetupWizard Step 0 via an unchecked-by-default checkbox that is separately checkable from the Terms of Service and required to advance. On the false→true edge, the server stamps landlords.smsConsentGrantedAt and writes a consent_grant row to sms_consent_audit with the consent text version, campaign tag, and timestamp. The Privacy Policy and Terms of Service carry the verbatim TCR no-sharing line.

Quick reference

Sub-processor list — vendors who process customer data on our behalf.
privacy@homerelay.app — data access / deletion requests (45-day response SLA, CCPA-aligned).
security@homerelay.app — vulnerability disclosure (48-hour acknowledgement, 5-business-day triage).

What we do not yet claim

We deliberately do not claim certifications or controls we have not implemented. The following are NOT in place today and are not claimed anywhere on this site:

SOC 2 (Type 1 or Type 2), ISO 27001, HIPAA, FedRAMP, or any equivalent attestation
Written Information Security Program (WISP) document
Quarterly tabletop exercises or scheduled third-party penetration tests
Multi-factor authentication for admin accounts
Published uptime SLA percentage
Bug-bounty program with cash payouts

These are part of our acquisition-readiness roadmap, we expect to revisit them as HomeRelay matures, and we will only publish them here once they exist.

Responsible disclosure

Report security vulnerabilities to security@homerelay.app. We acknowledge within 48 hours, triage within 5 business days, and will not pursue legal action against good-faith research that respects user privacy and avoids data destruction.