Security

Overview

My Compound is designed for multi-tenant compound operations. Security measures apply to the platform API, admin builder, and mobile apps described on this site.

Platform controls

• Tenant isolation: data is scoped by compound_id in the database and API layers.
• Passwords are stored as bcrypt hashes; we do not store plaintext passwords.
• API access uses signed JWT tokens with role-based permissions (resident, admin, worker, security, super_admin).
• Admin builder authentication uses an httpOnly cookie for the admin session.
• HTTP security headers via Helmet, and a CORS allowlist for browser clients.
• Audit log records for significant administrative actions.
• Image uploads are accepted through authenticated upload endpoints and served from a dedicated uploads path.
• Firebase Cloud Messaging tokens are stored to deliver push notifications you configure.

Data in transit

Production website and API traffic is served over HTTPS (TLS). Details of underlying infrastructure providers and any encryption at rest depend on hosting configuration; ask us during onboarding if you need documentation for a compliance review.

Your role

Compound administrators control which residents and staff receive accounts, which modules are enabled, and what operational data is collected. Use strong passwords and revoke access when staff leave.

Reporting security issues

If you believe you have found a vulnerability, contact us promptly with enough detail to reproduce the issue. Do not publicly disclose before we have had a reasonable chance to respond. [email protected]