Enterprise-Grade Security

Your Financial Data
Deserves Bank-Level Protection

DoorVault protects your most sensitive real estate financial data with multiple layers of encryption, strict access controls, and continuous monitoring. We built security into every layer of the platform.

AES-256
Encryption at rest
TLS 1.3
Encryption in transit
Passkeys & 2FA
Multi-factor auth
SOC 2 Type II
Infrastructure (Railway)

Security at Every Layer

From the moment your data enters DoorVault to how it's stored, accessed, and protected — security is never an afterthought.

Data Encryption

All data is encrypted at rest using AES-256 encryption. Every connection uses TLS 1.3. Sensitive data is encrypted with Fernet symmetric encryption before storage — we never store plaintext passwords.

Authentication

Sign in with passkeys (FIDO2/WebAuthn), Google, Apple, or email + password with TOTP two-factor authentication. Brute-force protection locks accounts after failed attempts. Session tokens auto-expire.

Cloud Infrastructure

Hosted on Railway (SOC 2 Type II compliant) with PostgreSQL managed databases. Documents stored on Cloudflare R2 with S3-compatible encryption. All infrastructure in US data centers with automated backups.

Audit Logging

Every sensitive action is logged with timestamps, IP addresses, and user context. Login attempts, data exports, document access, and admin actions are all tracked in an immutable audit trail.

Access Control

Role-based access with household data isolation. Each user only sees their own data. Household members share data only when explicitly invited. Admin actions require elevated verification.

Error Monitoring

Real-time error tracking with Sentry captures exceptions before they impact users. Uptime monitoring ensures 99.9%+ availability. Automated alerts notify our team of any anomalies within seconds.

Encryption That Never Sleeps

Your financial data is protected by multiple encryption layers. We use industry-standard AES-256 for data at rest, TLS 1.3 for data in transit, and Fernet symmetric encryption for sensitive credentials.

Document files stored in Cloudflare R2 are encrypted server-side. Database backups are encrypted. Even our AI document analysis pipeline processes data in memory and never persists raw text to third-party services.

AES-256 encryption at rest
TLS 1.3 in transit
Fernet credential encryption
Encrypted database backups
HTTPS enforced (.app domain)
No plaintext password storage
  • 1
    Your browser connects via TLS 1.3 encrypted HTTPS (mandatory for .app domains)
  • 2
    Cloudflare provides DDoS protection, WAF rules, and edge caching
  • 3
    Railway runs your app in isolated containers with encrypted network
  • 4
    PostgreSQL stores data with AES-256 encrypted volumes
  • 5
    Cloudflare R2 stores documents with server-side encryption
  • 6
    Fernet keys independently encrypt sensitive account data

Modern Authentication Built In

We support the most secure authentication methods available today. Passkeys (FIDO2/WebAuthn) provide phishing-resistant passwordless login. Google and Apple SSO let you leverage their security infrastructure.

For password-based login, we enforce strong hashing (PBKDF2-SHA256 with salt), automatic lockout after failed attempts, and optional TOTP two-factor authentication with backup recovery codes.

Passkeys (FIDO2/WebAuthn)
Google & Apple SSO
TOTP 2FA with backup codes
Brute-force lockout
Session invalidation on password change
Active session management
  • 1
    Login attempt checked against rate limits (5/minute per IP)
  • 2
    Password hash verified with PBKDF2-SHA256 (600,000 iterations)
  • 3
    2FA challenge required if TOTP is enabled
  • 4
    Session token generated with cryptographic randomness
  • 5
    Secure cookie set with HttpOnly, Secure, SameSite=Lax flags
  • 6
    Login event logged with IP, user agent, and timestamp

AI with Privacy First

Our Knox AI assistant uses Anthropic's Claude API to analyze your documents and transactions. Your data is processed but never stored by Anthropic, never used for model training, and never shared with third parties.

We implement prompt injection detection to prevent malicious documents from manipulating AI behavior. All AI outputs are validated and sanitized before being applied to your data.

Data never used for AI training
Prompt injection protection
Input sanitization & validation
Human-in-the-loop review
  • 1
    Document uploaded to encrypted storage (R2)
  • 2
    Text extracted locally within our infrastructure
  • 3
    Sanitized text sent to Anthropic API via encrypted connection
  • 4
    AI analysis returned (data not retained by Anthropic)
  • 5
    Results validated and shown for your review before applying
  • 6
    You approve which changes to apply to your data

Infrastructure & Compliance

Built on trusted infrastructure providers with enterprise security certifications.

Railway

SOC 2 Type II certified hosting platform with isolated containers and encrypted networking

PostgreSQL

Managed database with automatic backups, point-in-time recovery, and encrypted storage volumes

Cloudflare

Global CDN with DDoS protection, Web Application Firewall, and R2 object storage with encryption

Sentry

Real-time error monitoring and performance tracking with instant alerts for any security anomalies

Our Data Practices

Transparency about how we handle your data.

Data Deletion

You can delete your account and all associated data at any time. When you delete data, it's permanently removed from our databases and storage — no shadow copies, no hidden retention.

No Data Selling

We will never sell your data to third parties. Your financial information, documents, and property details are yours. We make money from subscriptions, not from selling your data.

Data Portability

Export your complete data anytime — properties, transactions, documents, tax reports. We support CSV, PDF, and Excel exports. Your data should never be locked in.

Ready to Secure Your Portfolio Data?

Join investors who trust DoorVault to protect their most sensitive financial information.

Get Started Free