Security

How your data is protected

• Every login needs two-factor: a code from an authenticator app, or your phone's own unlock (a passkey), on top of a password of at least 12 characters. Passwords are kept only as a one-way hash, so nobody can read them, us included.
• Wrong passwords and codes are limited: after too many tries, the login has to wait before anyone can try again. You get an email when your login signs in from a new device, and the website signs you out after 12 hours.
• Everything travels over an encrypted connection (HTTPS), and browsers are told to use nothing else.
• Each workspace is kept apart from every other by the database itself, not only by the app's pages, so one workspace's records can't show up in another's.
• Bank connection keys and two-factor secrets are stored encrypted. The daily backups are encrypted before they are saved and deleted after 30 days. A copy of each is kept off-site in a separate private storage account, and once a month one is restored as a test, to prove it works.
• Uploaded documents and photos are kept in private, encrypted storage. Each link to a file stops working after 5 minutes.
• Every page tells your browser to run only Command Center's own code, which stops most attempts to slip harmful code into a page.
• Every change to the app's code is checked automatically for known weaknesses, and each week an automated attack scanner is run against a test copy of the app.

Who can see your data

• The people you invite to your workspace, with the role you give them.
• Partners, lenders, contractors and tenants see only what you share with them: a lender sees the loan you shared, a contractor the rehab, a tenant their own lease. Nothing else in your records.
• Our staff can open a workspace read-only to help, for example when you ask for support. They can't change anything in your records, and every visit is logged.
• Bank connections go through Plaid. You type your bank login into Plaid, never into Command Center, so we never see your bank password. A connection can only read balances, transactions, loans and investments; it can't move money.
• Card payments go through Stripe. Your card number goes to Stripe, never to us.
• Your data is never sold. The Privacy Policy lists every company that helps run the service and what each one sees.

If something goes wrong

We keep a written plan for a security problem: who looks into it, how bank connections are cut off at once if needed, and how you are told. If a breach affects your data, we tell you as the law requires.

How to report a problem

If you think you've found a security problem, email support@realestateinvesting.org with "Security" in the subject. Tell us what you found, the page's address and the steps to see it again.

• Test only with your own login and your own workspace. Don't open, change or delete anyone else's data.
• Don't run anything that floods or slows down the app.
• Give us time to fix it before you tell anyone else.

We read every report and write back as soon as possible to say what we will do. Thank you for helping keep Command Center safe.