Security

What never reaches our servers

• Tenant details. When you prepare a notice, the tenant name and the details of the tenancy are entered on your own device and the document is built there. They are not sent to us, so there is no tenant database here to leak, sell or subpoena.
• The documents themselves. You download and keep them. We store a dated fingerprint, a SHA-256 hash, so you can later prove that exact file existed on that date. The fingerprint cannot be turned back into the document.
• Card numbers. Payment happens on Stripe. Card details go to Stripe directly and never touch our code or our database. We hold a customer reference and whether the subscription is active.
• Passwords. There are none. Signing in is a link sent to your email address, so there is no password to steal, reuse or reset, and a stolen database row is not a credential.

How what we do hold is separated

• Row-level policies keyed to your account. Every table holding a Guidepost Landlord Pass account's data has row-level security enabled and forced, with policies scoped to the account that owns the row. Forced matters: it means the rules apply even to the database owner, rather than being quietly skipped.
• Private file storage. A logo you upload is stored privately and read back under your own session, not from a public address somebody could guess.
• Uploads are re-encoded before they are stored. An uploaded image is decoded and written out again by our server rather than being passed through, so a file that is pretending to be an image does not survive the trip.
• Payment events are verified before they are believed. The webhook that can move your subscription state checks the cryptographic signature on every message and refuses anything unsigned. An unsigned message claiming somebody paid is a stranger, not a payment.
• Standard browser protections are set. A content security policy, strict transport security, frame denial, nosniff and a referrer policy are all sent with every page.

Practices, which are not the same as controls

These are things we do, rather than mechanisms that would stop us doing otherwise, and they are labelled that way on purpose.

• Server logs record status codes and table names, never request bodies and never rows. Captured errors are stripped of anything shaped like a key, a token or an email address before they are stored.
• Personal information is deleted on a schedule rather than kept indefinitely, and the schedule is the same number the deletion job runs on.
• The administrative screens sit behind a token and a signed session cookie. Nobody there can issue a refund, read a document, or see a tenant, because those abilities were never built.

What we do not have

No certification, audit or compliance standard. We hold no SOC 2, no ISO 27001, and no third party has assessed this. Claiming one would be the easiest sentence on this page to write and the only one you could not check.

Reporting a vulnerability

If you find something, tell us at support@guidepostcanada.ca with enough detail to reproduce it. We will acknowledge within five business days and tell you what we are doing about it.

We have no bounty programme and will not pretend otherwise. We ask that you do not access anybody else's data, and we will not pursue anybody who reports something in good faith and gives us a reasonable chance to fix it first.