Security
Money software has to be paranoid. Ours is.
RentPlus holds your rent roll, your tenants’ data and your books. Here is exactly how it is protected — from the outside, and from the inside.
The design
Protection from the inside out
Most property software worries about hackers. In practice, the bigger risk is closer: a shared password, a caretaker with too much access, a record quietly edited. RentPlus is designed so nothing important can happen silently.
Tamper-evident audit trail
Every meaningful action — a payment recorded, a lease edited, an approval bypassed — is written to a hash-chained audit log and periodically sealed. If any record is altered after the fact, the chain no longer verifies. Audit history is queryable per record and exportable for disputes.
Role-based access, to the bone
Over 100 typed permissions behind a default-deny guard on every route. Four ready-made roles — Administrator, Property Manager, Accountant, Viewer — plus a narrow gate-staff role for guards, custom roles, and per-person overrides when someone needs exactly one extra thing.
Two-factor authentication
Staff accounts support TOTP two-factor authentication with any standard authenticator app. Password logins are bcrypt-hashed and rate-limited against brute force.
Separate identity realms
Staff and tenants live in entirely separate authentication systems. Tenants log in with one-time codes to their own phone and hold no staff permissions of any kind — a tenant session physically cannot touch management functions.
Verified e-signatures
Document signers verify with a one-time code before signing. Every envelope carries a complete event log — invited, viewed, verified, signed — and completed documents are cryptographically sealed.
Encryption everywhere
TLS on every connection. Encryption at rest for the database, file storage and backups. Secrets live in a managed vault, never in code.
Enterprise-grade hosting
RentPlus runs on AWS with a production-isolated network, managed Postgres with multi-AZ failover, and continuous backups.
Your data stays yours
Ledgers, statements and reports export to CSV and PDF at any time. Visitor records support export and deletion, aligned with Kenya’s Data Protection Act.
Found something?
We take reports from security researchers seriously and respond quickly. Write to security@rentplus.ke with details and we’ll take it from there.
Ready to run your properties properly?
Start free, set up in an afternoon, and let the invoices send themselves.