Leasing HQ Trust Center

Leasing Headquarters holds sensitive leasing data: applicant identities, unit numbers, move-in dates, lease terms, documents, and staff activity. This page describes the controls we maintain. It supports the commitments in our Data Processing Addendum.

Data protection

• All traffic is encrypted in transit with TLS 1.2 or higher, with HSTS enforced.
• Data at rest is encrypted using AES-256 by our managed database provider.
• Passwords are stored only as salted hashes; we never see plaintext credentials.
• Payment card data is handled entirely by Stripe; we never receive card numbers.

Access control and tenant isolation

• Database row-level security scopes every record to a property, so users at one property cannot read another property's applicants or documents.
• Roles (staff, manager, administrator, super administrator) determine what a user can view and change. Role assignment is server-verified and users cannot escalate their own role.
• Administrative access to production is limited to named personnel, granted on least privilege, and requires multi-factor authentication.
• New accounts receive no property access until invited by a customer administrator.

Application security

• Security headers including HSTS, Cross-Origin-Opener-Policy, Referrer-Policy, Permissions-Policy, and X-Content-Type-Options are enforced on all responses.
• Server-side authorization checks on every privileged action; no trust in client state.
• Input validation on server functions and signature verification on payment webhooks.
• Automated dependency vulnerability scanning with prompt remediation of findings.
• Automated security scans of database policies, functions, and permissions.

Auditability

Applicant records maintain an audit log capturing who changed which checklist item or field and when. Administrators can review this history for accountability and dispute resolution.

Availability and resilience

• Hosted on managed, redundant infrastructure with global edge delivery.
• Automated encrypted database backups with point-in-time recovery.
• Target availability of 99.5% per calendar month, excluding scheduled maintenance.

Incident response

We monitor application and infrastructure logs for anomalies. If we confirm a security incident affecting customer data, we notify affected customer administrators without undue delay and within seventy-two (72) hours, with the facts known at the time and updates as the investigation proceeds.

Personnel

Personnel with access to customer data are bound by written confidentiality obligations, receive security guidance appropriate to their role, and have access removed promptly on role change or departure.

Integrations

Credentials and API tokens for platforms you connect are stored encrypted and used only to perform the integration you enabled. You can revoke an integration at any time from the Integrations screen, which immediately stops further syncing.

Responsible disclosure

If you believe you have found a vulnerability, contact us through the form on our homepage with details and reproduction steps. Please do not access data that is not yours, degrade the Service, or publicly disclose the issue before we have had a reasonable opportunity to remediate. We will acknowledge reports promptly and will not pursue action against good faith research that follows these guidelines.

Contact

The Wireless Advisors LLC D/B/A LeasingHQ
5900 Balcones Drive #32899
Austin, TX 78731

Platform evidence

For deployment-level checks and machine-readable technical evidence, review the independently generated platform evidence page. This evidence is supplemental and is not a SOC 2 certification or independent attestation.