PE Proper protects client property inventories, asset valuations, and photo evidence with tenant isolation and privacy safeguards.
Tenant-scoped application authorization controls are designed to prevent unauthorized cross-account record access.
Supported uploaded image formats are reprocessed to remove embedded EXIF metadata, including GPS coordinates, camera-identification fields, and EXIF timestamps.
Enforces single active session tokens to prevent unauthorized concurrent account sharing. Passwords are protected using PBKDF2-HMAC-SHA256 password hashing with per-password salts and appropriate work factors.
| Control Domain | Verified Technical Specification |
|---|---|
| Authentication | PBKDF2-HMAC-SHA256 password hashing with unique per-user salts. |
| Session Management | Single active session token invalidation upon sign-out or password rotation. |
| Tenant Data Isolation | Tenant-scoped application authorization controls are designed to prevent unauthorized cross-account record access. |
| Transport Encryption | TLS 1.2/1.3 encryption across all public HTTP endpoints. |
| Encryption at Rest | Database and uploaded-media storage are encrypted at rest using AES-256 through the underlying managed storage infrastructure (PostgreSQL & AWS S3). |
| Image EXIF Metadata | Supported uploaded image formats are reprocessed to remove embedded EXIF metadata, including GPS coordinates, camera-identification fields, and EXIF timestamps. |
| Security Incident Response | Security incident notification commitment as described in the Law-Firm DPA. |
| Retention & Deletion | Deleted matter data is removed from active systems and subsequently ages out of protected backups according to documented retention schedules within 30 days. |
| Compliance & DPA | Standard Law-Firm Data Processing Addendum publicly available for review: Review Law-Firm DPA → |