Security at Porchlight
Last updated October 25, 2026
Association records include homeowner names, contact details, and sometimes financial or personal circumstances. This page says plainly what protects that data today and what does not exist yet.
In place today
| Hosting | Amazon Web Services, United States (us-east-1). The application runs in private networks behind a web application firewall. |
|---|---|
| Encryption | Traffic uses HTTPS (TLS 1.2 or newer). The database and stored documents are encrypted at rest. |
| Tested access limits | Automated tests check on every change that people can reach only the communities, requests and documents their role and assignments allow. |
| Role-based access | Company admins, staff, board members and homeowners each see only what their role allows. Staff and board members reach only the communities assigned to them. |
| Passwords and sessions | Passwords are stored hashed, never in plain text. Sessions expire after an hour. Invite and reset links are single use. |
| Audit trail | Requests, board votes, decisions and notifications are recorded with who did what and when. |
| AI use | AI suggests categories, priorities and answers from an association's own documents, and shows its reasoning and sources. People make the decisions. Your documents and homeowner data are not used to train shared models. |
| Backups | The database takes automated backups. |
Not in place yet
- Independent security certification such as SOC 2 and a third-party penetration test. We will say so here when they exist.
- Multi-factor sign-in. It is being added.
- A published backup restore test and recovery targets.
Your data and leaving
Design partners own their data. We will agree exit terms in writing, including a full export of your association's data when you ask.
Report a concern
Use the contact form and put "Security" in the message. We read every submission.