Security at Tenvale

Every online payment on Tenvale — tenant card and ACH rent payments and landlord subscription billing — is processed by Stripe, which is certified as a PCI Service Provider Level 1 (the most stringent level of payment-industry certification). Card numbers and bank account details are entered into Stripe-hosted fields and go directly to Stripe. They never touch or get stored on Tenvale's servers.

Rent collected from tenants online settles through Stripe Connect into your own connected bank account — not into a Tenvale holding account. You keep the bank-of-record relationship. Payments you collect outside Tenvale (cash or check) can be recorded for bookkeeping, but the money never passes through us at all.

Application data lives in a Postgres database managed by Supabase, with row-level security enabled on database tables as a defense-in-depth layer beneath the application's own per-organization access checks. Every query in the application is scoped to your organization.

Uploaded files — leases, condition statements, work-order photos — are stored in private storage buckets. Nothing is publicly addressable: files are served only through short-lived signed URLs that are minted per-request, after the server verifies the requester is authorized to see that specific file.

All traffic between your browser and Tenvale is encrypted in transit with TLS (HTTPS everywhere). Data is encrypted at rest by our database and storage provider.

Sign-in is handled by Clerk, a dedicated authentication provider. Tenvale does not store your password — credentials and sessions are managed by Clerk. Within your organization, role-based access controls separate what owners, managers, staff, and tenants can see and do.

Tenvale is built for Massachusetts landlords, so MA General Laws c.186 §15B obligations are first-class features: security-deposit interest tracking, deposit-limit checks, and condition-statement tracking. These are tools that help you stay organized — they are not legal advice, and we are not a law firm. Consult an attorney for legal questions.

We do not sell your personal information. You can export your complete account data — properties, leases, payments, expenses, and more — at any time, and you can delete your account (subject to legal, tax, and accounting retention requirements for financial records). The details, including our subprocessor categories and retention windows, are in our Privacy Policy.

Tenvale does not yet hold SOC 2 or ISO 27001 certifications. We're an early-stage company, and we'd rather tell you that plainly than imply otherwise. What we do instead: payment processing is delegated entirely to Stripe (PCI DSS Level 1 certified), authentication to Clerk, and we follow the practices described on this page. If your situation requires audited certifications today, we may not be the right fit yet — and we'll tell you so.

Tenvale is operated by Tenvale LLC, a Massachusetts limited liability company. Found a security issue? Report it to support@tenvale.com — we read every report.