Security overview

Built to protect sensitive data at every layer

Rental applications contain some of the most sensitive personal and financial information people share. Here is exactly how Approvee protects it.

AES-256 encryption at rest
TLS in transit
Complete org isolation
Full audit trail
3-year document retention

Security is built into the platform's architecture, not added on top of it.

Encryption
  • Documents encrypted at rest. Every uploaded file (pay stubs, tax returns, photo IDs) is encrypted with AES-256 before being written to storage. The encryption key is never stored alongside the data.
  • PII encrypted in the database. Applicant financial data, employment details, and application answers are encrypted at the field level in the database.
  • Credentials encrypted per organization. DocuSign tokens and AI API keys are encrypted individually for each brokerage. One organization's credentials can never be accessed by another.
  • TLS for all data in transit. Every request to and from Approvee is encrypted over HTTPS/TLS. Unencrypted connections are rejected.
Access Control
  • Complete multi-tenant isolation. Each brokerage's data is fully isolated. No user can see, query, or access another organization's applicants, documents, or settings at any level.
  • Role-based permissions. Administrators, agents, and invited reviewers each have scoped access. Reviewers see only the specific applications they've been assigned, with no access to anything else.
  • Secure session cookies. Authentication cookies are HttpOnly (inaccessible to JavaScript), Secure (HTTPS only), and SameSite=Lax (cross-site request protection).
  • Multi-factor authentication. MFA is available for all user accounts and recommended for administrator access.
Document Security
  • Stored on Cloudflare R2. Documents are stored in Cloudflare's globally distributed, redundant object storage, not on ephemeral application servers that could lose data on restart.
  • Encrypted before upload. Files are encrypted on the server before leaving for storage. Cloudflare never receives plaintext documents.
  • Strict file validation. Uploaded files are validated by content (magic bytes), not just filename extension, to prevent disguised uploads.
  • Access-gated serving. Documents are served only to authenticated users with explicit access to that applicant. URLs cannot be guessed or shared outside the platform.
Application Security
  • Content Security Policy. Browsers are instructed to block requests to unauthorized origins, preventing data exfiltration and cross-site scripting attacks.
  • Clickjacking protection. X-Frame-Options and CSP frame-ancestors headers prevent the platform from being embedded in external frames.
  • CORS locked to approvee.org. Cross-origin API requests from any domain other than Approvee's own are rejected at the server.
  • Rate limiting. Authentication, document upload, and AI analysis endpoints are rate-limited per IP to prevent brute-force and abuse.
  • HSTS enforced. Browsers are instructed to always use HTTPS for Approvee for 2 years, including subdomains.
Data Management
  • 3-year document retention. Applicant documents are automatically deleted after three years, consistent with fair housing recordkeeping requirements. Deletion is permanent.
  • Full audit trail. Every significant action (document upload, AI analysis, screening decision, DocuSign send, document view) is logged with the user identity, timestamp, and IP address. Logs are immutable.
  • Soft delete with recovery window. Deleted applicant records enter a 30-day recovery window before permanent deletion, preventing accidental data loss.
  • Data never sold or shared for advertising. Applicant data is used exclusively for rental screening. It is never sold or used for advertising.
AI & Integrations
  • Your API key, your data. AI document analysis uses each brokerage's own Anthropic API key. Applicant data is never processed through a shared Approvee key.
  • Not used for AI training. Documents sent for AI analysis are not retained or used to train AI models, per Anthropic's API terms.
  • Per-org DocuSign isolation. Each brokerage connects its own DocuSign account. Credentials are encrypted individually and never shared across organizations.
  • Reviewer access is invite-only and scoped. Third-party reviewers (property owners, compliance contacts) access only the specific applications they are explicitly invited to, via time-limited secure links.

Technical specifications

For IT reviewers and security-conscious evaluators.

Control Detail Status
Encryption algorithm AES-256 via Fernet (symmetric authenticated encryption with HMAC-SHA256) Enabled
Document storage Cloudflare R2 (S3-compatible, geo-redundant object storage); documents encrypted before upload Enabled
Data in transit TLS 1.2+ enforced; HTTPS Strict Transport Security (max-age 63,072,000 s, includeSubDomains) Enabled
Session security HttpOnly · Secure · SameSite=Lax; configurable max-age; invalidated on logout Enabled
Multi-factor authentication TOTP (time-based one-time password); QR code enrollment via authenticator app Available
Content Security Policy default-src 'self'; restricts scripts, styles, connections, and frame-ancestors Enabled
Cross-origin protection CORS restricted to approvee.org; X-Frame-Options: DENY Enabled
Rate limiting Per-IP, DB-backed; applied to auth, upload (30/hr), and AI analysis (10/hr) endpoints Enabled
File validation Magic byte inspection on upload; PDF, JPG, PNG only; 20 MB limit per file Enabled
Audit logging Immutable log of all actions: user ID, org, action type, resource, IP, timestamp Enabled
Data retention Documents auto-deleted after 3 years; audit logs retained 7 years Automated
Tenant isolation org_id enforced on every query; no cross-org data access possible at the application layer Enforced
Dependency scanning pip-audit run against all dependencies; no known CVEs as of September 2026 Clean
Breach notification NY SHIELD Act (N.Y. Gen. Bus. Law § 899-bb) response procedures documented and in place In place

Questions about security?

We're happy to answer detailed questions from IT teams and compliance reviewers.

security@approvee.io Privacy Policy Terms of Service