Who can see your data, and who cannot
A society management system holds visitor logs, home addresses, phone numbers and children's movements. That deserves a straight answer rather than a badge.
What's enforced
Every record carries the society it belongs to, and that check happens in the database query rather than in application code. A committee member at one society reaching for another society's data gets nothing back.
Scoping is applied at the query level, not by filtering results afterwards, so there is no version of the request that returns a neighbour's invoice.
The resident directory shows the last four digits to other residents. The full number never leaves the server unless you are on the committee.
Not just in that browser. Signing out of all devices invalidates every token immediately, which matters when a gate tablet goes missing.
If a shared device is lost, a committee member can end that person's sessions from their own account, and it is written to the audit log.
A temporary password is shown once at invitation and cannot be retrieved afterwards — not by us, not by your committee.
What we can see
When you report a problem we cannot fix blind, an operator can open a session scoped to your society. It is read-only — nothing can be changed, including your ledger. It expires within the hour. And it is written to your own audit log, where your committee can see exactly who looked and when.
We are telling you this here rather than burying it, because access you find out about later is the kind that costs trust.
Your society decides what it records about residents, visitors and staff; we process those records on its behalf and are responsible for keeping them safe. For our own sign-up and contact records we are the data fiduciary. The details are in our privacy policy.
Being honest about the gaps
Things a serious buyer should ask about, before you have to ask.
Sign-in is a password, or a one-time code sent to your email. A second factor for committee accounts is planned but not built.
Data is encrypted in transit. At rest it depends on how the database is deployed, which we will confirm in writing for your society.
The isolation between societies is covered by an automated test suite, but no external security firm has audited this yet.