How we protect your data

Last updated Oct 21, 2026

You're trusting us with your books, your customers and your tenants. Here is what protects that information today, in plain words. It says only what the app does now; anything planned is marked as planned.

Where your data is stored

Today: in the United States. The app, its database, uploaded files and our own backups are on servers run by our hosting company, Hostinger, in the United States. While it's there, US courts and authorities may be able to access it under US law.

Once a month an administrator is reminded to download the newest backup, keep it on an encrypted external drive in Canada (not a cloud service), away from the server, and delete copies older than 90 days.

Planned: we're moving the app, its database and its backups to Canada, to Amazon Web Services' Montreal region (AWS Lightsail). It isn't done yet and we haven't set a date. This page and our Privacy Policies will say so the day it's done.

The database's own disks: we haven't yet confirmed with our hosting company whether they are encrypted, so we don't claim it. The planned database in Canada is encrypted at rest.

Your books and the CRA: the CRA requires business records to be kept in Canada unless it authorizes another place in writing, and it recommends keeping backups in Canada. Until the move, download your books each month (Money → Download for your accountant) and keep a copy in Canada. The app reminds owners monthly.

How your data travels

Pages are served over HTTPS, so what travels between your browser and the app is encrypted, and our site tells browsers to use HTTPS only (HSTS).

The app hands each email to its mail service over an encrypted connection. After that, like any email, it's delivered to and kept in the recipient's mailbox.

Passwords are never stored as you type them: only a one-way scrambled form (a bcrypt hash) is kept, so nobody here can read your password.
Two-step sign-in is open to everyone: a code from an authenticator app on your phone, plus single-use recovery codes in case you lose it. We recommend turning it on (Security, in the menu).
Sign-in attempts are limited, so someone guessing passwords is refused for a while, and changing your password signs out every other device.
Keys to connected services (such as a bank feed) and two-step sign-in secrets are stored encrypted (AES-256-GCM).

Each business's data is kept apart

Every page, download and action checks which business or landlord account you're working in, and only shows that account's records. Another account's records answer "not found", even with the right link.

Automated tests check this separation on every change to the software, before it can reach the live site.

Who can see it

Your business, and the people you invite. Each team member sees only what their role allows (for example, only the owner can reopen closed books unless they allow it).
For landlords: tenants see only their own tenancy, owners only their own properties, and contractors only the jobs offered or given to them.
Our support, only by "viewing as" you to help with a problem. Each session ends after 60 minutes at most and is recorded when it starts, at each change made through a form, and when support stops it. While viewing as you, support can't sign documents or give consent, and can see only whether two-step sign-in is on: it can't see or change your password, two-step codes or recovery codes.
Today only the founder has administrator access to the live systems.

Backups

A full copy of the database is made every night (the newest 7 are kept) and before every update that changes the database (the newest 5). None of our own backups on the server is kept longer than 90 days. They're on the same hosting service as the app, in the United States. Our hosting company may also make its own backups of the server, on its own schedule.

Every change to the software rehearses making a backup of test data and restoring it, automatically, before it can be released. Restoring the newest real backup into a separate, temporary database to check it is scheduled twice a year (April and October); none has been recorded yet.

If we ever have to restore a backup, we first re-apply our record of deletions, so an account or a person deleted after that backup stays deleted.

What's recorded

Every change an administrator makes, and every "view as" session, is recorded in an audit log (who, what and when), kept 24 months.
Every email and text the app sends is recorded with whether it was sent. Personal links in the stored copies are hidden.
Failed sign-in attempts, with their network address, are kept for one day, only to stop password guessing. Sign-up and public forms (rental applications, viewing bookings, contact) use the network address to limit repeated submissions.
When a lease is signed in the app, the network address and the device's browser details are kept with the signature, as proof of who signed.
When something goes wrong, the error is recorded for 12 months. Before an error report leaves our server (to GitHub, where we fix problems), email addresses, phone numbers, long numbers and quoted values are removed.
A business's activity log records who changed which record, and when.

When an account closes

Businesses: the owner is first offered every record to download, then everything the business has in the app is deleted.
Landlords: everyone on the account is signed out at once, and the account's records are deleted 30 days later (until then it can be reopened). Billing records tax law requires us to keep are kept as the Privacy Policy describes.

Our own backups on the server that still hold it are deleted within 90 days, and the monthly copy in Canada is to be deleted at the same age. Any backups our hosting company makes follow its own schedule.

Outside services, and what they see

A few companies help run the app. Each gets only what it needs:

Hosting (Hostinger, United States): everything in the app, as described above.
Email (Hostinger's mail service, or Resend in the United States): each email's address, subject and contents.
Texts (Twilio, United States), only where texting is turned on: the phone number, the text, and any reply.
Address suggestions (Google, United States), only where they're turned on: the part of an address being typed, sent from our server, never names.
Payments (Stripe), for a landlord's subscription: card details are typed on Stripe's own page and never reach us. Stripe receives the landlord's email, our reference number for the account, the number of units billed, and whatever the landlord types on its page.
AI (Anthropic), only for landlords who turn on the AI assistant: a repair request (the problem as the tenant wrote it, the city and the type of repair), the facts of a unit for a listing, or problem rows of a spreadsheet the landlord uploads. We don't add names or contact details from your records, but a repair request's own words are sent as written. In spreadsheet rows, emails and phone numbers, and columns headed as names, are replaced first; other cells (such as addresses) are sent as written. Anthropic doesn't use it to train its models. The books don't use AI.
Error reports (GitHub, United States): email addresses, phone numbers, long numbers and quoted values removed first.

We never sell your data

We don't sell personal information, don't use it for advertising, and don't send our own marketing to your customers or tenants. We use only our own cookies: to keep you signed in, remember your language, show a new private link once right after you make it, and remember a referral code you followed. No advertising, analytics or third-party tracking cookies.

Canadian privacy law, and asking for your data

Our Privacy Policies are written for Canada's federal privacy law (PIPEDA) and, in Quebec, Law 25.

You can download your records yourself at any time: businesses under My data, landlords under Settings.

To see, correct or get a copy of other information we hold about you, write to residentservice@jamesstreetchateau.com. We'll confirm it's you and answer within 30 days. You can also complain to the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d'accès à l'information.

No system is perfectly secure. If a breach creates a real risk of significant harm, we'll tell the people affected and the Privacy Commissioner of Canada and, in Quebec, the Commission d'accès à l'information, as the law requires.

The details

The full rules are in the Privacy Policies: