Security
How we protect your investors' data.
Managers trust EasyHaus with identity documents, tax numbers and bank details of their investors. This page describes the measures in place today, in plain terms.
Measures in place
Encryption
Data is encrypted in transit, and the most sensitive fields are encrypted again in the database.
- All traffic uses TLS, with HSTS.
- Tax IDs, identity document numbers, bank account numbers, beneficial owner identifiers, second-factor secrets and recovery codes are encrypted with AES-256-GCM. The key is kept outside the database and can be rotated.
- Encrypted fields are shown in full only to owners and admins, masked elsewhere, and never written to logs.
- The audit trail masks encrypted fields, email addresses and phone numbers.
Separation between organizations
Every organization is an isolated tenant.
- Every database query is scoped to one organization, and an automated check rejects queries that are not.
- An isolation test suite creates two organizations with identical data and checks that no endpoint returns or changes the other's records.
- A record from another organization answers as not found, so its existence is not revealed.
- A portal session belongs to one organization and one address, and is refused anywhere else.
Accounts and sign-in
Sign-in is protected against guessing and theft of sessions.
- Passwords are hashed with argon2id, must have at least 10 characters and are checked against known breaches.
- Two-factor authentication with an authenticator app and recovery codes. Owners can require it for every member.
- Ten wrong codes in a row lock the second factor for an hour and email the user.
- Session tokens are random 256-bit values stored only as hashes, with idle and absolute expiry. Users can see and end their sessions.
- Resetting a password ends every session; changing it ends all the others.
- Sign-in, reset and emailed-link requests are rate limited, and emailed links work once.
Access by EasyHaus staff
Our staff do not browse customer data.
- Support can act inside your organization only after your owner turns on support access, and must give a reason each time.
- Support sessions can change a limited set of records. They cannot invite members, change security settings or read decrypted identifiers.
- Every support action is recorded in your audit trail, and turning support access off ends live support sessions.
- The platform administration area requires two-factor authentication and short sessions.
Application security
Common web attacks are addressed in the design.
- A strict Content Security Policy with per-request nonces, and pages cannot be framed by other sites.
- Every state-changing request needs a custom header, and cookies are HttpOnly, Secure and SameSite.
- Uploads are checked by size and by their actual content, limited to an allowlist of types, and served as downloads. Images are decoded and re-encoded, which strips metadata.
- Upload links are short-lived and can be used once.
- CSV exports escape cells that a spreadsheet would run as formulas.
- Requests are validated strictly, and errors never expose internal details.
- Dependencies are scanned for known vulnerabilities with govulncheck and pnpm audit.
Records and accountability
You can show what happened, and when.
- An audit trail of every change: who, what, before and after, when, from which address. It cannot be deleted.
- Document acknowledgements record the user, the version, the time and the file hash.
- Every document download is checked and logged.
Privacy and data rights
Tools to answer your investors' requests.
- Export one client's data as a ZIP, or your whole organization's data.
- Erase a client: personal fields are replaced and documents deleted, while financial records keep an anonymised name.
- Deleting an organization keeps it recoverable for 30 days, then purges its data and files.
- Only strictly necessary cookies by default. Google Analytics on the marketing site and the app runs only with your consent where the law requires it. No advertising cookies.
Reviews and testing
An internal security review of the application was completed in October 2026 and its findings were fixed. An independent penetration test has not been carried out yet.
Reporting a vulnerability
If you believe you have found a security issue, please tell us through the contact form with the topic Security report, and leave out exploit details until we reply. Please do not access data that is not yours or disrupt the service while testing.
Questions from your compliance team?
We are happy to go through these measures with you.
