Security

Security & Privacy

Specifics rather than badges. Every line below is something you can check: in the app, in our privacy policy, or on our infrastructure provider's own security page.

No bank login for rent

Rent collection works from the Interac e-Transfer notices you forward by email. AnchorLease does not ask for your online banking login to record rent, and a transfer is recorded only after you confirm it.

  • Rent keeps landing in your own account as before
  • Each forwarded notice is matched to a tenant and period, then waits for you
  • Nothing is recorded until you confirm

Listings never show your address

A public listing shows the area and a circle of about 150 m, with no street number, no map pin and no landlord name. The exact address is emailed to an applicant only after you confirm their viewing.

  • Postal code shown to the first three characters only
  • The circle is offset from the real location and never moves
  • Your name and email are not on the public page

Legal records cannot be rewritten

Notices, service records and certificates of service can be added to but not edited afterwards — the database refuses the change. What a record said on the day it was made is what it still says.

Separated by database rule, not by screen

Tenant and landlord access is enforced in the database itself, so a bug in the interface cannot expose one to the other.

  • Row-level security on every table holding your data
  • Verified before each release that anonymous access returns nothing
  • Tenants see their own payments and documents, nothing else

Encryption

Encrypted in transit over TLS, and at rest with AES-256 by the database platform. Access tokens are encrypted again before they are stored.

Where your data lives

Supabase in the United States, which holds SOC 2 Type 2 and ISO 27001 — certifications we rely on rather than claim as our own. Cross-border storage is set out in our privacy policy.

PIPEDA-aligned practices

AnchorLease follows Canadian PIPEDA privacy requirements. We collect only what's needed and give you control over your data.

  • Data retention periods documented in the privacy policy
  • Right to access, export and delete your data
  • Cross-border storage disclosed

No sale of personal data

We do not sell your personal information or use it for advertising. Third-party processors used to run the service are described in the Privacy Policy.