Security
We built LetCore to keep your property, tenant and compliance data protected and isolated to your organisation — explained here in plain language, not marketing claims.
How your data is protected
Encrypted in transit
Every connection to LetCore is served over HTTPS, using the same TLS encryption standard your bank’s website uses, so data moving between your browser and our servers can’t be read in transit.
Encrypted at rest
Your properties, tenants, compliance and task data is stored in encrypted form on disk, not as plain readable text, by our managed cloud database provider.
Verified sign-in, every request
Access to your account is checked against our authentication service on every request to a protected page — not just trusted from a stored cookie — so a stale or forged session can't be used to get in.
Your data stays in your workspace
Properties, tenants, tasks and documents are designed to be scoped to your organisation through row-level security policies defined in our database schema, not just in application code. We are continuing to verify this enforcement against our live database as an ongoing internal review.
Server-side authorization
Server-side routes for actions like sending emails and generating reports independently verify who is asking before acting, rather than trusting values sent from the browser.
Abuse protection on public endpoints
Public-facing endpoints such as the contact form apply request-rate limiting to reduce spam and automated abuse.
Organisation-scoped access control
Every account belongs to exactly one workspace for now, and permissions (owner, admin, member) are enforced through that workspace membership.
How your data is encrypted, in plain terms
There are two moments where your data could be exposed if it weren’t protected: while it’s travelling between your device and our servers, and while it’s sitting in our database. We encrypt both.
- In transit: every page and request to LetCore uses HTTPS with TLS encryption — the same lock-icon technology your browser shows on banking and shopping sites. If someone intercepted the connection, what they’d see is scrambled, unreadable data, not your property or tenant details.
- At rest: once your data reaches our servers, it’s stored on disk in an encrypted form by our managed cloud database provider, not as plain, readable text. Someone with access to the raw storage still couldn’t read it without the separately-held decryption keys.
- Passwords: your password is never stored as plain text or in a form we could read back — it’s passed through a one-way cryptographic hash before it’s stored, so even we can’t see or recover the original password.
Data isolation
LetCore runs on a managed PostgreSQL database. Our database schema defines Row-Level Security (RLS) policies that scope property, tenancy, compliance, task and document data to your organisation, so that the database itself — not just application code — is designed to check that a request belongs to your organisation before returning or changing a row. Verifying this enforcement against our live, deployed database is an ongoing internal review; we do not yet treat every relation as independently confirmed in production. If you'd like more detail on current verification status, get in touch.
Access control and sign-in
- Sign-in is handled by our authentication provider (email/password, and Google or Microsoft where enabled).
- Every visit to a protected page is checked against our authentication service directly, rather than trusting a locally-stored session token on its own.
- Within an organisation, roles (owner, admin, member) determine what a member can see and change.
Server-side authorization
Server-side routes we've built for actions like sending emails or generating reports independently re-check the caller's identity and organisation membership on the server, rather than trusting values supplied by the browser. This is not a claim that every action across the product is routed through server-side authorization today. Public-facing routes that don't require sign-in, such as the contact form, apply rate-limiting to reduce automated abuse.
What we don't claim
We're an early-stage product and we want to be straightforward about that. We do not currently hold SOC 2, ISO 27001 or any other formal security certification, we have not commissioned an independent penetration test, and we do not offer contractual data-residency, backup or uptime guarantees. If any of these matter for your organisation, please get in touch and we'll tell you exactly where things stand.
Reporting a concern
If you believe you've found a security issue with LetCore, please email info@letcore.co.uk with details. We'll investigate and respond as quickly as we can.