Information Security Policy
Effective September 27, 2026 · Product app.freehomemanager.com · Entity Scale-Right, Inc.
Written for people, not auditors.
This is a plain-English description of how we protect your data, meant to be read by users and by partners evaluating Home Manager. We do not claim SOC 2, ISO 27001, or GDPR certification. Where we describe a practice as “aligned with” an industry framework, that means we designed it to match common practice in that framework — not that an outside auditor has certified it.
1. Encryption
- In transit: all traffic to and from Home Manager is encrypted over TLS/HTTPS.
- At rest: uploaded documents and photos are stored in encrypted object storage — AWS S3 with KMS server-side encryption enforced at upload time, not just a bucket setting we could quietly change.
- Database: application data is stored in a managed PostgreSQL database (Neon), with encryption at rest provided by our database infrastructure.
2. Access control and least privilege
- Authentication is handled by a dedicated identity provider (Auth0), not a password store we maintain ourselves.
- Tenant isolation: access to another household's or organization's data is enforced at the database level using PostgreSQL Row-Level Security, in addition to application-level checks — so a bug in one layer doesn't expose another customer's records.
- Administrative access is limited to a small number of authorized staff, goes through a separately authenticated path from ordinary user access, and is logged.
- We follow the principle of least privilege throughout — components and staff accounts get only the access they need.
3. Application security controls
- Encrypted, authenticated sessions with CSRF protection on every data-changing action.
- Rate limiting on sign-in and on data-changing requests.
- Security headers, including a Content Security Policy, on every page.
- Server-side input validation on every form and API request — we don't trust the browser alone.
- Generic, non-identifying error messages; detailed error information is never exposed to users.
4. Document and file safety
Every file you upload is scanned for malware (ClamAV-based scanning) before it can be viewed again — a file that hasn't passed the scan is never served, not just flagged. Uploads are restricted by file type and size, and stored in private storage that isn't directly browsable; access always goes through an authenticated, authorized request.
5. Logging, monitoring, and incident handling
Security-relevant events — sign-ins, sign-outs, permission changes, data exports, data deletions — are written to an append-only audit log that cannot be altered after the fact, including by us. If we become aware of a security incident affecting your data, we investigate promptly, contain and remediate it, and notify affected users without undue delay. We welcome vulnerability reports from security researchers and users — see the contact below.
6. Data retention and deletion
We retain personal data for as long as needed to provide the service and meet legal, security, and audit obligations, after which it's deleted or de-identified. You can request export or deletion at any time — see our Privacy Policy.
7. Data residency
Our infrastructure providers — Vercel, AWS, and Neon — are U.S.-based companies, and our infrastructure runs on U.S. regions.
8. Sub-processors
| Vendor | Role |
|---|---|
| Auth0 | Identity provider — authentication and sessions |
| Vercel | Application hosting |
| Neon | Managed PostgreSQL database |
| AWS (S3 + KMS) | Encrypted object storage for uploaded files |
Each is contractually and technically limited to the service described and may not use your data for its own purposes.
9. Third-party integrations — Spectora and Keller Williams Command
Some users choose to connect Home Manager to third-party services they, or their inspector, agent, or loan officer, already use — currently Spectora and Keller Williams Command. This section is written to be read by a partner evaluating whether to allow the connection.
- Read-only, least-privilege API scopes. Each connection requests only the minimum read-only scope needed for the specific data type in question. We do not request or implement any ability to write, edit, or create records back in Spectora or Keller Williams Command in the current build.
- Per-connection, encrypted credential storage. Each connection's API key or OAuth token is sealed independently using AWS KMS envelope encryption before it is stored. Credentials are never stored in plaintext.
- Revocable, per-user connections. Each connection belongs to the individual professional who created it. That person can revoke it at any time, immediately invalidating the credential and stopping further data pulls.
- Webhook signature verification where the partner supports it, before any payload is accepted.
- Nothing is auto-applied. Data flows into Home Manager only, and only into the account of the person who connected it, only after that person reviews and accepts it.
- We access both services only through an authorized API connection using the connecting professional's own credentials — never by scraping. We are completing our review of Keller Williams' API License Agreement as part of our partner application, and won't enable that connection against live Keller Williams data until that review is complete.
10. Your role
Security is shared. Use a strong, unique password (or your identity provider's own protections), don't share your login, and tell us right away if you believe your account has been compromised.
11. Changes to this policy
We may update this policy as our practices evolve. Material changes will be posted here with an updated effective date.
12. Contact
Scale-Right, Inc. — William.Anthony@scaleright.com
© 2026 Scale-Right, Inc. Home Manager.