Safeguarding your housing applications
Your household answers, portal logins and signatures are encrypted at rest and never sold.
How we protect your information
- Envelope encryption (Google Cloud KMS). Dates of birth, linked portal credentials, paper application profiles, electronic signature images and optional Social Security numbers are Fernet-encrypted (AES-128-CBC + HMAC-SHA256) at rest with master keys wrapped in Google Cloud KMS (FIPS 140-3 Level 3 HSM).
- No AI training or data selling. Your household answers, income figures and portal sign-ins are never sold, shared for advertising, or used to train third-party AI models. RentMaxxer runs with zero ad trackers, pixels or session-replay scripts.
- SOC 2 Type II infrastructure. All application compute, database storage, payment processing and email delivery run in the United States on SOC 2 Type II and ISO 27001 certified providers, protected in transit by TLS 1.2+ / TLS 1.3 and strict HSTS.
- Passwordless & strict access. Accounts use single-use 15-minute sign-in links stored only as SHA-256 hashes. Every page enforces a strict Content-Security-Policy with SHA-256 script hashes, CSRF tokens and
HttpOnly; Secure; SameSite=Laxcookies. - Complete audit logging. Every portal lottery filed, paper PDF packet generated, electronic signature placed and consent checkbox ticked is recorded in an audit log visible on your account page and your dashboard.
- One-click revocation & deletion. Unlink any housing portal, revoke your electronic signature, export your data in JSON, or permanently delete your account and all encrypted records at any time from your account settings.
Subprocessors & compliance verification
RentMaxxer inherits physical, network and hardware security controls from independently audited US infrastructure providers:
| Layer | Provider | Certifications & Controls | Verification |
|---|---|---|---|
| Key Management & HSM | Google Cloud KMS | SOC 1/2/3, ISO/IEC 27001, 27017, 27018, FIPS 140-3 Level 3 | Google Cloud |
| Compute & Encrypted Postgres | Fly.io (US Regions) | SOC 2 Type II, isolated Firecracker microVMs, encrypted NVMe volumes | Fly.io Security |
| Billing & Payments | Stripe | PCI-DSS Level 1 Service Provider, SOC 1 Type II, SOC 2 Type II | Stripe Security |
| Transactional Email | Resend | SOC 2 Type II, GDPR, DKIM / SPF / TLS enforced | Resend Security |
| HTTP & Transport Hardening | RentMaxxer Web Tier | HSTS, CSP with SHA-256 script hashes, X-Frame-Options DENY, Permissions-Policy | security.txt |
Reporting a vulnerability
To report a security vulnerability or request security documentation, email security@rentmaxxer.com (see /.well-known/security.txt). For privacy or data-deletion requests, see our Privacy Policy or email privacy@rentmaxxer.com.