Architected for stewardship.

Every HOAxis tenant gets a dedicated Postgres schema. Queries are routed to the right schema by host-resolution middleware before they reach the application code. Cross-tenant SELECTs aren't prevented by application logic — they're refused by the database.

• Each tenant: own schema name, own search_path
• Per-tenant postgres.js client, per-schema lock keys
• Tenant's board credentials cannot reach platform.*
• Platform operator session is a separate cookie

Every mutation — homeowner action, staff action, system event — appends a row to an audit log with the actor, the entity, the field, and the before/after values. The platform layer keeps a separate audit log of operator actions across tenants. Logs are append-only.

• Field-level diffs inside the tenant
• Platform-wide log for operator actions
• Every API mutation logs an event
• Searchable / filterable in the operator console

Staff accounts can enroll in time-based one-time-password 2FA using any authenticator app. Multi-role per user (a Treasurer can also be an ARC Member). Symmetric account lockout on repeated failed sign-ins with admin-clearable counters.

• iron-session cookies, secure + httpOnly + sameSite
• Per-user TOTP enrollment
• Multi-role assignments
• Failed-attempt counters + lockout window

Standard Postgres. No proprietary file formats. Full CSV + JSON export at any time, including all audit logs. If you ever leave HOAxis, you walk away with everything — and we destroy our copy on request, evidenced in our SOC 2 report.

• CSV + JSON export of every table
• Includes audit logs
• Cancellation deletes within 30 days
• No proprietary data formats

Edge-network TLS for all customer traffic. Database connections require TLS (sslmode=require). Service-to-service calls within our infrastructure use mutual TLS or scoped service tokens.

• TLS 1.2+ to the edge
• sslmode=require on Postgres
• No insecure HTTP fallbacks
• Vercel-managed certificate rotation

Hosted Postgres providers (Vercel Postgres, Neon, Supabase) provide point-in-time recovery. We document our incident response playbook and notify affected tenants within 72 hours of any confirmed incident — well within most disclosure regulations.

• Provider-managed daily backups
• Point-in-time recovery (PITR)
• Documented incident response plan
• Tenant notification within 72 hours