Security & Data Protection
Prop Insights is built local-first. If you’re running the desktop app or a self-hosted Docker container, your property, mortgage, and account data lives in a SQLite database on your own machine and is never transmitted to us — the only outbound traffic is to the specific third parties a feature needs (address autocomplete, licensing, billing, transactional email), each over HTTPS. If you’re on the cloud (web) version, the same data model runs on our infrastructure instead, secured as described below.
Infrastructure
Section titled “Infrastructure”The cloud version runs on Fly.io. All traffic is served over TLS, with plain HTTP requests redirected automatically. The application layer only communicates with the database and storage over Fly’s private internal network, never the public internet. Security-relevant response headers (HSTS, X-Frame-Options, X-Content-Type-Options, a Content-Security-Policy, and a locked-down CORS origin) are applied to every request.
Authentication
Section titled “Authentication”- Passwords are hashed with
scrypt(a random salt per user, timing-safe comparison) — never stored in plaintext, never logged. - Multi-factor authentication (MFA) is available on every account: standard TOTP (compatible with any authenticator app — Google Authenticator, 1Password, Authy, etc.), set up via QR code, with one-time backup codes issued at setup for account recovery. Backup codes are hashed the same way passwords are, not stored as plain text.
- Sessions use random, unguessable bearer tokens with a fixed expiry, invalidated immediately on password change.
- Rate limiting is applied to login, signup, and password-reset endpoints to slow down credential-guessing attempts.
Data Encryption
Section titled “Data Encryption”| Cloud (web) | Desktop / self-hosted | |
|---|---|---|
| In transit | TLS enforced everywhere — your browser, our servers, and every third-party integration we call all communicate over HTTPS | Traffic never leaves your machine (localhost) |
| At rest | Database and uploaded files are encrypted at rest at the infrastructure layer | Covered by your operating system’s own disk encryption (FileVault on macOS, BitLocker on Windows) — we recommend enabling it |
Virus Scanning
Section titled “Virus Scanning”Every document you upload (leases, contracts, insurance certificates, etc.) is scanned for malware before it’s stored, using an up-to-date antivirus engine with automatically refreshed signatures. If scanning capability is ever degraded for any reason, our team is alerted immediately so it can be restored — this isn’t something that’s checked manually or occasionally, it’s built into the upload path itself.
Data Isolation
Section titled “Data Isolation”Every account’s data is strictly isolated from every other account’s. On the cloud version, this is enforced at the database query level, not just in the application UI — there’s no code path that can return one user’s data in response to another user’s request.
Keeping the Platform Secure
Section titled “Keeping the Platform Secure”Every change to the codebase passes through automated checks — including dependency vulnerability scanning and a full automated test suite — before it’s deployed. Dependencies are kept current and re-audited on an ongoing basis, and we run periodic internal security reviews covering authentication, data isolation, and the API surface as a whole.
Reporting a Concern
Section titled “Reporting a Concern”If you believe you’ve found a security issue, please email hello@prop-insights.app with details. We take reports seriously and will follow up directly.