Security at Landager

2. Infrastructure

• Our application servers and PostgreSQL database run on servers rented from Hetzner Online GmbH in Germany.
• Traffic reaches us through Cloudflare, which provides DNS, TLS termination and network-level protection.
• Uploaded files (lease documents, photos, receipts, ID documents from applications) are stored in a private Cloudflare R2 bucket that has no public access.

3. Encryption

• In transit: every connection to the website, the dashboard and the tenant portal uses HTTPS (TLS).
• Passwords: stored only as bcrypt hashes; we cannot read them.
• Sensitive applicant data: ID numbers, dates of birth, income, employer, address and phone from tenant applications are encrypted in the database (AES-256-GCM), with keys kept outside the database.
• Backups: encrypted (GPG, AES-256) before they leave our servers.

4. Accounts & Access

• Signing in with a password also requires a second step: a one-time code sent to your email, or, if you turn it on, a code from an authenticator app (with one-time recovery codes). You can also sign in with Google.
• Repeated failed sign-in attempts lock the account temporarily.
• Sessions expire after 3 days without use and 14 days at most. Changing or resetting your password signs you out everywhere, and you can sign out of every device from Settings.
• If our support team needs to look at your account, the session is read-only by default, ends after 30 minutes, shows a banner, and everything it does is recorded in your account's audit log. Support can never change billing, passwords or two-step settings, export or delete your account.
• Tenants use a separate portal with their own sessions; they can see only their own lease and payments.
• Our internal admin tools use separate credentials from customer accounts, require two-factor authentication, and sit behind an access gate (Cloudflare Access).

5. Data Isolation

• Every request that reads or changes a record checks that the record belongs to the signed-in account.
• Files open only through short-lived signed links issued after that ownership check.
• Public forms (tenant applications, maintenance requests) are protected by single-use links, email verification codes, rate limits or bot protection.
• Uploaded files are checked by their content (not just their name), scanned for malware, and counted against a storage limit per account.

6. Audit Log

• Sign-ins (including failed attempts), security changes such as passwords and two-step settings, changes to your records, billing events, data exports and deletion requests, emails we send, and every action our staff take are recorded in an audit log. Each entry says who did what and when, from which IP address and browser, and for changes, the values before and after. Passwords, sign-in codes and full ID numbers are never recorded.
• The application can add entries but cannot change or delete them. Each month's entries are linked in a chain of cryptographic hashes, so an altered or removed entry shows up when the chain is checked. We check the chains every day and keep a daily copy of the chain heads outside the database.
• You can see your account's activity in Settings → Activity, including everything Landager support does during a support session.
• Our staff see the audit log according to their role; analysts see personal details masked.
• Entries are kept online for 24 months, then archived and deleted once they are 7 years old. See the Privacy Policy for details.

7. Backups

The database is backed up every day. Each backup is encrypted and copied off-site, and restoring from an off-site backup has been tested.

8. Payments & AI

• Subscriptions are processed by Lemon Squeezy, our merchant of record. Card details go to Lemon Squeezy, never to our servers.
• The AI assistant sends your question and the portfolio details needed to answer it to Google's Gemini API. See the Privacy Policy for what is sent and stored.

9. What We Are Improving

We would rather tell you than overstate. Work currently planned includes:

• A stricter content security policy for the dashboard (no inline scripts).

10. Reporting a Vulnerability

If you believe you have found a security problem, please email [email protected] with the subject "Security". Please give us a reasonable time to fix it before disclosing it publicly. We do not take legal action against good-faith research.