SECURITY
Your deals stay yours.
How we protect your account, your data, and your payments.
Authentication
Accounts sign in with email and password verified by a one-time code, or with Google. Sessions are managed by our hosting platform; we never see or store your Google password.
Data isolation
Saved underwrites, comps, and offers are stored per user. Database access rules restrict every business table to administrators, and all reads and writes go through backend functions that check who you are before returning anything.
Encryption in transit
All traffic to the app and its backend uses HTTPS. Team invite links are stored only as hashes plus an encrypted copy.
Payments
Card payments are processed by Stripe. Card numbers never touch our servers and are not stored by us.
Fraud prevention
To protect free-plan limits we keep salted hashes of phone and device signals, never the raw values. These signals are retained for 12 months.
Retention and deletion
Your saved work is kept until you delete it or close your account. You can request full deletion of your personal data by contacting support, and we will erase it from our records.
Subprocessors
Base44Hosting, database, authentication, email
StripePayments and billing
BatchDataProperty and sales data
RapidAPI / RealtorListing photos
Google MapsStreet View imagery and maps
MapboxMaps and walking-distance areas
What we don't do
- We do not sell your data.
- We do not store card numbers.
- We do not show your deals to other users.
- We do not call home sellers who use our report.
Responsible disclosure
Found a vulnerability? Email security@underwritey.com. Please give us reasonable time to fix it before sharing publicly.