How we protect your data.

Authentication

• Magic-link email sign-in via Supabase Auth. No passwords stored, no password databases to leak.
• Magic links expire in 1 hour and are single-use.
• Sessions are HTTP-only cookies, refreshed automatically.

Encryption

• All traffic is HTTPS (TLS 1.3 where supported).
• The database (Postgres at Supabase) is encrypted at rest. Evidence-packet PDFs in Supabase Storage are encrypted at rest and access-controlled per-user.
• Stripe handles all payment data; we never see card numbers.

Access control

• Row-level access controls in the database, your data is only readable by your authenticated session.
• Our small operations team has read-only access to operational data when investigating issues. Access is logged.
• We do not have access to county recorder accounts on your behalf, we use public read APIs.

What data we hold

• Your email, optionally your name and phone number.
• The addresses and parcel IDs of properties you ask us to monitor.
• Recorded documents we’ve pulled from county systems for your parcels.
• Alert history and any notes you’ve made on incidents.
• Stripe customer and subscription IDs (no card data).

Data retention & deletion

• You can delete your account any time from your profile, your data is removed within 30 days.
• We retain recorded-document history for 7 years for evidence-purposes, even after account deletion, to support any law-enforcement or civil proceeding you might later need. This is anonymized after deletion (no link back to your identity).
• Operational logs are kept for 90 days, then purged.

Infrastructure

• App hosting and CDN: Vercel (US regions). Database, storage, auth: Supabase (US). Email: Resend. SMS: configurable provider. Payments: Stripe.
• We don’t use third-party analytics or session-replay tools. The only tracking on this site is a first-party session cookie.

Responsible disclosure

If you find a security vulnerability, email security@deedshield.net. We acknowledge within 24 hours, triage within 72 hours, and credit you in our security advisories (with your permission). Please don’t publicly disclose until we’ve had a chance to fix.

We do not currently run a paid bug bounty program, but we recognize good-faith research and we’ll work with you to resolve issues quickly and respectfully.

Compliance

DeedShield is not subject to HIPAA, SOC 2, or PCI DSS directly, we don’t handle health data or store cards. Stripe handles PCI compliance on our behalf. Supabase’s underlying infrastructure (AWS) has SOC 2 Type II. We’re committed to meeting GDPR and CCPA standards for the personal data we do hold.

If something goes wrong

In the event of a data breach affecting your information, we will notify you by email as soon as we’re reasonably able, and in accordance with applicable breach-notification laws (within 72 hours for GDPR-covered users; under 30 days for most US states).