Security and data
Your tenants' records, handled carefully.
What we protect, how, and what stays under your control - written plainly, without promises we cannot keep.
How it is protected
What is in place today.
Every item here describes how Upa works now, not a plan.
Passwords never stored readable
Passwords are kept only as one-way hashes. Repeated failed sign-ins from the same place are slowed down, so guessing is impractical.
Two-factor sign-in
Turn on a 6-digit code from an authenticator app, with single-use backup codes for a lost phone. The codes are stored hashed too. No SMS codes - SIM swaps are too easy.
Every account walled off
Each property, tenant, bill and payment belongs to exactly one account, and every lookup is filtered by it.
Private statement links
A tenant's link is a long random token, not a guessable number. Blocking a tenant switches their link off.
Meter photos kept private
Photos are stored outside the public web folder and shown only to signed-in users of the same account.
Protected forms and sessions
Every form carries an anti-forgery token, sessions are renewed at sign-in, and every page is served over HTTPS.
An audit trail
Sign-ins, bill runs, payments and admin changes are written to an audit log, so "who changed this?" has an answer.
We never hold tenant money
Tenants pay you directly. Upa keeps the record of billed and paid; no card numbers are ever stored.
Your data
Your records, your rules.
- You control your tenants' data. Under the Data Privacy Act of 2012 you are the personal information controller for your tenants; Upa processes their data on your behalf, for billing only.
- Export on request. Ask and we export your properties, tenants, statements and payments to a spreadsheet, including when you leave. A self-serve export button is Rolling out
- Nothing deleted when a plan lapses. Your account becomes read-only; every record stays readable.
- Deletion when you ask. Close your account and we delete your records, apart from what the law requires us to keep.
What we do not do
- Sell or rent anyone's data
- Put advertising trackers in the app
- Contact your tenants for our own purposes
- Build features to cut a tenant's utilities
Found a security problem?
Tell us privately through the contact form or Messenger before sharing it anywhere else. We will confirm we received it, fix it, and tell you when it is done.