Skip to main content
    HomeRelay

    Trust Center

    Last updated: August 27, 2026

    HomeRelay handles property, tenant, and vendor data on behalf of independent landlords. This page is the single source of truth for the security, privacy, and automation-disclosure controls we maintain. We publish only claims we can back with a code test, anything still in the roadmap appears at the bottom of this page, never in the present tense.

    Security controls

    Data in transit encrypted via TLS

    All HTTPS traffic to homerelay.app runs over TLS, terminated by the platform. All outbound webhook traffic (Stripe, Twilio, SendGrid, OpenAI, Anthropic) is HTTPS-only.

    Data at rest encrypted (Neon + Backblaze B2)

    Our PostgreSQL database (Neon) uses provider-managed encryption at rest. Off-site database backups are stored in a private Backblaze B2 bucket with default SSE-B2; HomeRelay also requests AES-256 server-side encryption on every configured object-store write.

    Tenant PII encrypted at the application layer

    Tenant names and email addresses are encrypted application-side with AES-256-GCM before being written to the database, disk-level encryption is a second layer, not the only layer.

    All authenticated sessions rotate on login

    In production, identity and session tokens are issued and automatically rotated by our auth provider (Clerk): a login establishes a fresh session, and the server derives a real account's identity only from the provider's verified session, never from a reusable cookie, so a pre-set session cannot be inherited (session-fixation prevention). The only cookie-based path is the isolated, synthetic demo sandbox, which carries no real account or customer data.

    Per-session CSRF token with rotation after every mutation

    Every authenticated session carries a 30-minute CSRF token (constant-time compare). After each state-changing request the server issues a fresh token via the `X-New-CSRF-Token` response header.

    HTTP security headers (CSP, HSTS, X-Frame-Options, etc.) enforced

    Per-request CSP nonce, X-Frame-Options DENY, X-Content-Type-Options nosniff, Referrer-Policy `strict-origin-when-cross-origin`, Permissions-Policy denying camera/mic/geo, and production-gated HSTS `max-age=31536000; includeSubDomains`.

    File upload MIME validation via magic-byte enforcement

    Uploads pass through a canonical magic-byte + MIME validator with a per-category allowlist (invoice / receipt / lease doc / photo). Video containers additionally run an ISO BMFF box-size sanity check.

    Vulnerability disclosure: 48-hour acknowledgement, 5-business-day triage

    Reports to security@homerelay.app are acknowledged within 48 hours and triaged within 5 business days. We will not pursue legal action against good-faith research that respects user privacy.

    Breach notifications follow applicable law

    If we confirm a breach affecting personal information, we assess the affected data and notify people and regulators when and as applicable law requires, including any legally permitted investigation or law-enforcement delay. We do not claim one universal 72-hour customer-notice clock.

    AI and automation disclosures

    Outbound automated SMS is labeled in-channel

    Every dispatch SMS HomeRelay sends to a vendor or tenant is prefixed with [Automated message from HomeRelay's AI on behalf of {landlord name}]. The disclosure lives at the point of interaction, there is no separate marketing page that softens it.

    Outbound automated voice calls are labeled up front

    Every dispatch voice call HomeRelay places to a vendor opens with the same disclosure: it is HomeRelay's AI assistant calling on behalf of the named landlord. The call says so before anything else.

    AI-generated content reaching end users is labeled

    AI-generated replies in the tenant portal include disclosure language identifying them as an automated response.

    Protected-class attributes redacted from vendor communications

    Before any maintenance message goes to a vendor, HomeRelay strips federal fair-housing protected-class framing (race, color, religion, national origin, sex, familial status, disability) from the message. We do not generate rental listing copy.

    HomeRelay takes no cut of maintenance spend

    Vendors invoice the landlord directly, at the price the vendor sets. HomeRelay adds nothing to that bill: no markup, no referral fee, no percentage of maintenance spend. We never move repair money and run no vendor payment rail, so the automation that dispatches a vendor has no financial stake in what the work costs.

    Privacy

    We do not sell personal information

    HomeRelay has no data-broker integrations, no advertising-network pixels (Google Ads, Meta, TikTok), and does not engage in cross-context behavioral advertising. Any product analytics we run is opt-in via environment configuration and is never resold.

    Sub-processors disclosed inline

    Every third-party service that processes customer data (the configured object-storage provider, Stripe, Twilio, SendGrid, OpenAI, Anthropic, Fly.io, Neon, and others) is named in our Privacy Policy. The list is updated when a new integration ships.

    Smart Import OCR processing is disclosed

    Smart Import source files can contain names, addresses, contact details, lease or payment terms, invoices, warranties, and other source content. For image OCR, the full uploaded image is sent through our configured AI inference service before extracted text can be locally redacted. Our Privacy Policy identifies this service-provider processing.

    Global Privacy Control (GPC) signal acknowledged

    Browsers that send Sec-GPC: 1 are flagged at the server boundary; we respond with X-GPC-Honored: 1. The signal is a no-op today because we do not sell personal information, but the gate is in place if that ever changes.

    Data access and deletion requests honored

    Email privacy@homerelay.app to request a copy of your data or to delete your account. We verify identity and respond within 45 days (CCPA-aligned).

    TCPA and SMS controls

    STOP / HELP / START keywords honored across all SMS

    Replying STOP opts a phone number out of all future automated SMS from HomeRelay. HELP returns a canonical help message. START re-opts in. Enforcement is centralized so every send path checks the same opt-out state.

    Per-state quiet hours enforced for non-emergency SMS

    Non-emergency dispatch SMS is gated to local 8 AM – 9 PM, with state-specific tightening where the law requires it (FL 8 PM cutoff). Emergency classification is the only bypass and is logged.

    TCPA consent log retained for 5 years

    Every consent grant, opt-out event, and emergency override is logged with a 5-year retention horizon. This exceeds the FCC §64.1200(d) 4-year floor and the FL FTSA 4-year statute-of-limitations window.

    Toll-free SMS sender verification approved

    Our SMS sender identity is a Twilio toll-free number whose verification for "Property Management / Maintenance Dispatch" messaging was approved in July 2026, with explicit STOP/HELP handling and the quiet-hours policy described above. Verified toll-free sending is the carrier registration path for toll-free numbers; A2P 10DLC campaign registration applies to local 10-digit numbers, which we do not send from.

    Landlord SMS consent collected at signup

    Landlords opt in to receive HomeRelay SMS notifications at SetupWizard Step 0 via an unchecked-by-default checkbox that is separately checkable from the Terms of Service and required to advance. On the false→true edge, the server stamps landlords.smsConsentGrantedAt and writes a consent_grant row to sms_consent_audit with the consent text version, campaign tag, and timestamp. The Privacy Policy and Terms of Service carry the verbatim TCR no-sharing line.

    Quick reference

    What we do not yet claim

    We deliberately do not claim certifications or controls we have not implemented. The following are NOT in place today and are not claimed anywhere on this site:

    • SOC 2 (Type 1 or Type 2), ISO 27001, HIPAA, FedRAMP, or any equivalent attestation
    • Written Information Security Program (WISP) document
    • Quarterly tabletop exercises or scheduled third-party penetration tests
    • Multi-factor authentication for admin accounts
    • Published uptime SLA percentage
    • Bug-bounty program with cash payouts

    These are part of our acquisition-readiness roadmap, we expect to revisit them as HomeRelay matures, and we will only publish them here once they exist.

    Responsible disclosure

    Report security vulnerabilities to security@homerelay.app. We acknowledge within 48 hours, triage within 5 business days, and will not pursue legal action against good-faith research that respects user privacy and avoids data destruction.