Skip to content

Security & Data Protection

Prop Insights is built local-first. If you’re running the desktop app or a self-hosted Docker container, your property, mortgage, and account data lives in a SQLite database on your own machine and is never transmitted to us — the only outbound traffic is to the specific third parties a feature needs (address autocomplete, licensing, billing, transactional email), each over HTTPS. If you’re on the cloud (web) version, the same data model runs on our infrastructure instead, secured as described below.

The cloud version runs on Fly.io. All traffic is served over TLS, with plain HTTP requests redirected automatically. The application layer only communicates with the database and storage over Fly’s private internal network, never the public internet. Security-relevant response headers (HSTS, X-Frame-Options, X-Content-Type-Options, a Content-Security-Policy, and a locked-down CORS origin) are applied to every request.

  • Passwords are hashed with scrypt (a random salt per user, timing-safe comparison) — never stored in plaintext, never logged.
  • Multi-factor authentication (MFA) is available on every account: standard TOTP (compatible with any authenticator app — Google Authenticator, 1Password, Authy, etc.), set up via QR code, with one-time backup codes issued at setup for account recovery. Backup codes are hashed the same way passwords are, not stored as plain text.
  • Sessions use random, unguessable bearer tokens with a fixed expiry, invalidated immediately on password change.
  • Rate limiting is applied to login, signup, and password-reset endpoints to slow down credential-guessing attempts.
Cloud (web) Desktop / self-hosted
In transit TLS enforced everywhere — your browser, our servers, and every third-party integration we call all communicate over HTTPS Traffic never leaves your machine (localhost)
At rest Database and uploaded files are encrypted at rest at the infrastructure layer Covered by your operating system’s own disk encryption (FileVault on macOS, BitLocker on Windows) — we recommend enabling it

Every document you upload (leases, contracts, insurance certificates, etc.) is scanned for malware before it’s stored, using an up-to-date antivirus engine with automatically refreshed signatures. If scanning capability is ever degraded for any reason, our team is alerted immediately so it can be restored — this isn’t something that’s checked manually or occasionally, it’s built into the upload path itself.

Every account’s data is strictly isolated from every other account’s. On the cloud version, this is enforced at the database query level, not just in the application UI — there’s no code path that can return one user’s data in response to another user’s request.

Every change to the codebase passes through automated checks — including dependency vulnerability scanning and a full automated test suite — before it’s deployed. Dependencies are kept current and re-audited on an ongoing basis, and we run periodic internal security reviews covering authentication, data isolation, and the API surface as a whole.

If you believe you’ve found a security issue, please email hello@prop-insights.app with details. We take reports seriously and will follow up directly.