Skip to main content
RentalKey

Security

Your property records should stay in your workspace.

RentalKey is being built with privacy and account separation as product requirements, not optional polish.

Start owner trialSign in

Protected owner access

Owner records sit behind authenticated website sessions. Public visitors cannot browse owner workspaces.

  • Owner routes require a valid session
  • Billing gates do not replace data authorization
  • Internal staff login will move to a separate domain

Separated workspaces

Database access rules are designed to restrict each owner to their own organisation records.

  • Supabase Row Level Security foundation
  • Server-side owner checks
  • Cross-owner access tests

Private documents

Rental documents are stored privately with access granted only through authorised workflows.

  • Private storage buckets
  • Signed download/preview access
  • Owner-controlled tenant sharing

Invitation-only portals

Tenant and tradie access works only after an owner enables portal access for the matching email address.

  • Accepted and last-seen tracking
  • Access revocation controls
  • Separate tenant and tradie portals

Minimal-data principle

RentalKey should collect enough information to run rental workflows, not excessive applicant or tenant data.

  • No automated tenant rejection
  • Consent-first future screening
  • Privacy/legal review before commercial launch

Responsible account security

Use a unique password and protect access to the email account used for RentalKey. Two-factor authentication is planned before general release.

  • Password login and magic link
  • Password reset still pending
  • Leaked-password protection depends on Supabase plan

Common questions

Can one owner see another owner's property records?

Owner workspaces are designed around Supabase Row Level Security and server-side ownership checks so each owner only accesses records linked to their organisation.

Are rental documents public?

No. Rental documents are stored privately and should only be shared through authorised owner, tenant or tradie workflows.

Is the internal RentalKey operations login on this website?

No. Internal staff access is intentionally excluded from the public sign-in chooser and is planned for a separate internal domain.