Security by design

Security you can hand your board

hoapay holds your community’s money, personal records, and governance data. Protecting it isn’t a feature we bolted on — it’s the architecture. Here’s exactly how we keep every subdivision’s data safe, at the database, in production, and everywhere in between.

The one principle everything rests on

The client is never trusted. Your browser can ask for anything it likes — our database decides what it’s actually allowed to do. Every safeguard below is enforced on the server and inside the database, not merely hidden in the interface. A bug in the app can’t hand out data the database won’t release.

Per-subdivision data isolation

Every record belongs to exactly one subdivision and is walled off from all others.
A member of one HOA can never read or touch another HOA’s data — enforced inside the database, not just the interface.
Access is checked against your active membership and role on every single request.

Database security

Row-Level Security is enabled on every table that holds community data.
Policies verify membership and role for each read, write, and management action; anything not explicitly permitted is denied by default.
Runs on managed PostgreSQL, encrypted at rest and in transit.
Privileged database credentials never leave the server — they are never shipped to the browser.

Authentication & access control

Every authorization decision re-verifies your identity with the auth server — we never trust a token that could be altered on the device.
Seven precise roles (admin, treasurer, auditor, homeowner, security, visitor, LGU); each sees only what its role allows.
Protected areas are gated by middleware before a page ever loads.
Passwords are hashed by our authentication provider and never stored in plain text.

Production & transport

Every page and request is served over HTTPS, with HSTS forcing encrypted connections (two-year policy, preload-ready).
A strict Content Security Policy limits exactly what can run or load on each page.
Clickjacking is blocked, MIME-sniffing is disabled, and referrer and browser-permission policies are locked down.
Hosted on enterprise-grade cloud infrastructure with a global edge network.

Backups & recovery

The production database is backed up automatically by our managed database platform.
Backups are encrypted, and the platform is continuously patched and monitored for availability.
Infrastructure is operated by established providers on hardened, redundant systems.

Application safeguards

Every write is validated against a strict schema before it reaches the database.
Which subdivision and who submitted a record are set from your verified session — never from form input a client could forge.
User-entered content is escaped by default to prevent cross-site scripting; we don’t inject raw HTML.
Dependencies are audited and high-severity issues resolved before release.

Infrastructure

Built on hardened, managed infrastructure

Rather than run our own servers, we build on established providers whose systems are continuously patched, monitored, and backed up — so your data sits on infrastructure that’s maintained around the clock.

Database, auth & realtime

Managed PostgreSQL, authentication, and live updates run on Supabase, with row-level security and encryption built in.

Hosting & edge network

The application is hosted on Vercel’s global edge network, served over HTTPS with a strict security-header suite on every route.

Found a security issue?

We take reports seriously and welcome good-faith research. Email us with the details and steps to reproduce, and please give us a reasonable window to investigate and fix before any public disclosure. We won’t pursue researchers who act in good faith.

info@hoapay.cloud · This overview reflects our current practices and evolves as the platform does.

Run your subdivision on a platform built to protect it

Get started free — your community’s data is isolated and secured from day one.