In short
- Sensitive fields, such as tax IDs, identity numbers, bank accounts and two-factor secrets, are encrypted in the database, and shown in full only to owners and admins.
- Every organization is isolated. Queries are scoped to one organization, and tests check that nothing leaks between two.
- An audit log records every change and cannot be deleted. Document downloads are logged.
- Sign-in has two-step verification and passkeys, and you can require them for your team.
- EasyHaus staff cannot browse your data. Support access is off until you allow it and is limited and logged.
The details are on the Security page. The legal terms are in the DPA and the privacy policy.
Your side of the responsibility
- You decide who is on your team and their role. Review the list from time to time, and remove people who leave.
- You are the controller of your investors' personal data. EasyHaus processes it for you.
- You answer your investors' requests with the export and erasure tools. See Client data export and erasure.
- You keep the records your jurisdiction requires. EasyHaus keeps financial records after an erasure for that reason.
Reporting a problem
If you believe you found a security issue, write through the contact form with the topic Security report and leave out exploit details until we reply.