This page is maintained by Baumann Property Managment to answer common security and privacy questions about the platform. It describes current practices and is not an independent certification.
Accounts are protected by email and password, with email confirmation required before access is granted. New account owners can register to create their own private workspace, while team members join existing workspaces by invitation only. Every user signs in with their own credentials, and a valid per-user session is required for all application access.
Staff, owners, tenants, accountants and vendors each see only what their role permits. Permissions are enforced on the server with row-level security in the database, not just hidden in the interface.
Records — properties, leases, payments, maintenance, documents and messages — are scoped to the account that owns them. Users from one account cannot read or change another account's data.
All traffic between your browser and our platform is served over HTTPS/TLS. Credentials and session tokens are never transmitted in clear text.
Uploaded documents are kept in a private storage bucket. Files are served through short-lived, access-checked links so only authorized users can open them.
The application is built and hosted on the Lovable platform with a managed Postgres database and serverless backend. These are platform capabilities we rely on; this page is not a certification or independent audit.
We process the operational data needed to manage rental properties — contacts, leases, payments, maintenance and related documents — on behalf of the account that owns it. For data access, correction, export or deletion requests, please contact the administrator of your account or reach our team using the details below. Specific retention periods and data-processing terms are provided by Baumann Property Managment on request.
If you believe you have found a security issue, please contact us so we can investigate. Include enough detail to reproduce the issue and avoid accessing or modifying data that is not yours. We appreciate responsible disclosure.