Security

Every connection to Estatz uses HTTPS (TLS 1.3 on current browsers), and browsers are told to always use a secure connection.

Passwords must be at least 12 characters, are checked against known breached passwords, and are stored only as a one-way hash (scrypt) - never in plain text. New accounts must verify their email. After 5 failed sign-ins we ask for a security check, and after 10 the account is locked for 15 minutes. Two-factor authentication with an authenticator app, with backup codes, is available to every user, and we recommend turning it on. Resetting your password signs out your other sessions.

Every workspace is kept separate inside the database itself with row-level security. The account the application uses to read data cannot bypass it, so every request only sees the workspace it belongs to.

Access tokens and API keys for the services you connect - Meta, property portals, DealVoice and WhatsApp - are encrypted with AES-256-GCM before they are stored. Two-factor secrets and backup codes are encrypted too.

Requests are rate-limited, with stricter limits on sign-in and password reset. Forms are protected against cross-site request forgery, pages are served with strict security headers, and messages from Stripe, Meta and our calling and SMS providers are accepted only with a valid signature.

Important actions - sign-ins and failed sign-ins, password and two-factor changes, role changes, data exports and billing changes - are recorded with the time and IP address. Workspace owners and managers can review them. Entries cannot be edited or deleted by the application, and are kept for 365 days.

Access to the Estatz administration console is limited to one administrator account, which must use two-factor authentication and a separate PIN.

Your workspace data is stored in Frankfurt, Germany (European Union). Card details are handled by our payment processor; we do not store card numbers. See our Privacy Policy for how we use and keep your data.

If you believe you have found a security problem, email hello@estatz.app. Please do not test against other customers' data.