Trust & Security
Alarm codes. Safe combinations. Entry credentials. Guard rotations. The information stored inside Property Portfolio Suite is the kind of detail a household trusts to very few people. The platform is engineered, governed and audited accordingly.
The four pillars
Four commitments shape every line of code, every database row and every operational decision. They apply to family households and enterprise portfolios alike.
Authenticated encryption at rest
Sensitive fields are encrypted before they are written to disk using AES-256-GCM with a unique 12-byte nonce per value. AES-GCM is an authenticated cipher: tampering with the ciphertext causes decryption to fail, so corruption and confidentiality are detected together.
Mandatory two-factor sign-in, hardware-key step-up for admins
Every sign-in, for every user, on every device, requires a single-use six-digit code delivered to the user's registered email (and to WhatsApp where a phone number is on file). There is no way to turn it off. Administrator accounts go further: a registered WebAuthn / FIDO2 hardware security key (YubiKey or platform authenticator) is required to reveal sensitive credentials. A stolen password alone, even an admin password, cannot unlock alarm codes or safe combinations.
Codes never displayed on screen
Alarm codes, safe combinations and door entry credentials are never rendered in the interface. Each reveal requires a fresh password challenge and a single-use email link that self-destructs ten minutes after issue or on first click, whichever comes first.
Tamper-evident audit log
Every sign-in, code reveal, dossier export and document download is written to a hash-chained audit log. Any retroactive modification or deletion, including by someone with direct database access, breaks the chain at the affected row and is reported by an administrator integrity-check tool.
Sensitive credentials
A code request follows the same controlled flow whether it is an alarm PIN, a safe combination or a master Wi-Fi password. There are no shortcuts.
The user signs in with their username, password and a fresh six-digit code delivered to their registered email and, where configured, WhatsApp.
On the relevant directory entry they click the request icon. The interface never shows the code at any point.
A modal asks them to re-enter their password. This protects against a casual borrower of an unlocked device.
On success, a single-use secure link is sent to the user's registered email address. The link is valid for ten minutes and self-destructs on first click.
The code appears on a dedicated secure-view page in the same signed-in session. Closing the tab or revisiting the link returns nothing.
The request and the subsequent reveal are both written to the tamper-evident audit log with the actor, IP address, device class and timestamp.
Defence in depth
The brief from senior clients is unambiguous: a stolen admin credential, an insider risk, or a lost device can do more damage than a sophisticated external attack. The platform is engineered with that in mind.
Bulk-export rate limits with alerting
Property dossier PDFs, document downloads and the audit log itself are capped per user per minute and per hour. The audit log being rate-limited is deliberate: an attacker who reached a privileged session cannot quietly exfiltrate the audit trail, because doing so would itself trigger an immediate alert. Once a daily threshold is crossed, administrators receive an alert by email naming the account, the export type, the count and the originating IP.
Emergency property lockout
When a phone or laptop is lost, or a staff member's behaviour gives concern, a single click freezes every sensitive field on the affected property. Code-reveal requests return locked until an administrator re-authenticates and clears the lockdown. Both the lock and the unlock are loud entries in the audit log.
Code-rotation report
When a team member leaves, administrators can generate an immediate list of every credential they have requested or revealed since they joined, so each can be rotated. The report is built from the audit log itself, so there is no separate state to maintain or to fall out of sync.
Hardened HTTP responses
Every API response carries Strict-Transport-Security (two years, preloaded), a strict Content-Security-Policy, X-Frame-Options=DENY, Referrer-Policy=no-referrer and Permissions-Policy denying camera, microphone, geolocation, payment and USB access by default.
HttpOnly cookie session model
Authentication tokens are held in HttpOnly, Secure, SameSite cookies. They cannot be read by JavaScript running in the browser, which neutralises an entire class of cross-site scripting attacks. The session can be presented to our servers but never extracted from the user's device.
Enforced password policy
Passwords are validated against a written policy at registration, password change and password reset: minimum eight characters, mixed case, at least one numeral and at least one symbol. The rule is enforced both in the browser and on the server; weaker passwords are rejected before the account is created.
Operational posture
Hosting & data residency
The platform runs on ISO-certified cloud infrastructure with logical isolation per estate. Each client estate sits in its own database namespace, and every query is scoped by tenant identifier so two estates can never see one another's records. The most sensitive fields (alarm codes, safe combinations, CCTV credentials) are encrypted at the application layer using AES-256-GCM before they reach the database. The host cannot read them. Only your authenticated session, after a step-up authentication challenge, can decrypt them. Specific data-residency commitments and an executed Data Processing Agreement are confirmed at contract for enterprise client estates.
Role-based access
Permissions are granular. Family members, property managers, view-only collaborators and administrators each see a different scope of information. Sensitive sections can be locked down per role.
Backups & recovery
Database backups are managed by the underlying cloud provider. A documented recovery procedure exists; the schedule for restoration drills, and the resulting recovery-time and recovery-point evidence, will be published once verified.
Incident response
A written incident response process governs investigation, containment and client notification. In the event of a personal-data breach, affected clients are notified within the 72-hour window required by UK GDPR.
Session controls & new-device alerts
Every user can review their active sessions and sign out remote devices. A sign-in from a previously unseen device or a new country triggers an immediate alert by email and, where configured, WhatsApp. Inactive sessions are signed out automatically.
Public surface, no third-party requests
Nothing inside a client portfolio is visible without authentication. The only public surfaces are the marketing site, the new-client enquiry form and the sign-in routes. The platform carries no advertising networks, no third-party analytics, no marketing-attribution scripts and no behaviour trackers. All typefaces are served from Property Portfolio Suite's own servers, so no visitor's IP address is shared with Google or any other font provider on page load. Strictly necessary cookies only.
Administrator IP allowlists
Administrator accounts can be pinned to a list of approved IP addresses. A sign-in from any other address is refused before the password is even evaluated, and the attempt is recorded in the audit log. Time-boxed travel mode can be granted when an administrator is genuinely on the move; the allowance expires automatically and is logged on both ends.
Multi-stage account approval
No new account becomes active until an administrator approves it. Approval is staged: identity verification, payment confirmation, and a separate go-live gate. A registered user cannot reach client data on registration alone.
Trust evidence
The controls below are live in the platform today. Detailed policy summaries and sub-processor information are available to prospective clients under NDA.
Tamper-evident audit log
Every audit-log entry is sealed into a per-tenant SHA-256 hash chain. An administrator can run an integrity check at any time which walks the chain, recomputes each row's hash and reports any break with the exact row and reason.
AES-256-GCM at rest + TLS 1.2+ in transit
Authenticated AES-256-GCM for every sensitive field at rest. TLS terminated at the platform ingress, supporting TLS 1.3 where the client negotiates it.
Responsible vulnerability disclosure
An open mailbox at security@propertyportfoliosuite.com, a published policy at /trust/vulnerability-disclosure and a /.well-known/security.txt file. Researchers acting in good faith are credited and protected from legal action.
Public sub-processor list
Every third party that processes customer data is listed at /trust/sub-processors with the categories of data it sees. Customers are notified by email at least 30 days before any addition.
UK GDPR compliance
The platform is built to the requirements of UK GDPR, including data subject rights (access, rectification, erasure), lawful processing, sub-processor governance and the 72-hour breach notification obligation.
Mandatory MFA on every account, encrypted vault, sealed audit log
The three highest-impact controls that sit beneath every recognised certification are already in production and visible to every client.
Corporate identity
Statutory identity, registered office and insurance posture, kept current and available for procurement review.
Registered name
Property Portfolio Suite Limited
Company number
17411633 · England and Wales
Registered office
66 Paul Street, London, EC2A 4NA, United Kingdom
Incorporated
20 August 2026
ICO registration
Application pending; reference published once granted.
Insurance
See the dedicated section below for the platform's insurance and financial protection framework.
Insurance and financial protection
Ordinary cyber cover is not designed for a platform that holds physical-security credentials for private residences. The programme being placed for Property Portfolio Suite Limited is specialist by design.
Specialist Cyber, Technology and Professional Indemnity insurance forms part of the client protection framework at Property Portfolio Suite Limited. The programme is designed to respond to the specific exposure of holding physical-security credentials for private residences, including cyber-triggered incidents that lead to loss or damage of tangible third-party property.
Property Portfolio Suite does not accept or hold a client's security credentials, floor plans or sensitive residence data until the required insurance protection is in force for that client's onboarding. This is an operational rule enforced within the platform, not a promise on paper.
Insurer, programme structure and current limits of indemnity are shared with each client under NDA before onboarding, alongside the platform's Information Security Management System, sub-processor list and executed Data Processing Agreement. Where the client's own insurer or family-office adviser wishes to review the programme directly, that dialogue is welcomed.
What the programme is designed to respond to
The programme is structured on the principle that policy wording matters more than a headline number. The insurance must actually respond to the scenario the platform is built to defend against.
Evidence for procurement teams
Confidential briefing pack
The material below is prepared for lawyers, family-office operations directors, HNW insurance brokers and procurement reviewers acting on behalf of a prospective client. It is publishable under NDA; the full Data Processing Agreement and executed sub-processor terms are exchanged directly with each client.
The consolidated Information Security Policy, Data Protection Impact Assessment and "Where Your Data Lives" reference. Editorially styled, distributed under NDA.
Every third-party service that processes client data on the platform's behalf, the data categories it sees, and the residency of its systems.
How the platform receives and triages security research findings, and the safe-harbour posture for researchers.
For DPA execution, insurance certificate references, penetration-test reports or a walkthrough of the audit-log design.