Security
Built to be audited.
Property teams trust Reqzi with visitor logs, resident details and building activity. This page is the whole answer: what is in place, who processes data on our behalf, what we have not certified yet, and how to reach us about any of it.
This page covers Reqzi for buildings. Reqzi Go publishes its own providers and practices in the Reqzi Go privacy notice.
Security, in brief
- Data location
- The database and file storage are hosted in London and the API runs in Europe. Web hosting and push notification delivery run on global providers; the table below gives the region for each.
- Encryption
- TLS in transit, encryption at rest on managed database infrastructure. Uploads are scanned before they are stored.
- Access control
- Role-based permissions per application, TOTP two-factor for admins, and enforcement of 2FA at the organisation level.
- Certifications
- Reqzi is not ISO 27001 or SOC 2 certified today. We would rather say so than imply an audit we have not had. Stripe handles payments and holds PCI DSS Level 1.
- Data processing agreement
- Available on request for Reqzi for buildings. Reqzi Go publishes its addendum, listed with every other document on the legal page.
- Reporting a vulnerability
- Email hello@reqzi.com. We read every report and reply as quickly as we can.
Controls
What is actually in place
Six controls, described the way they are implemented rather than the way they market.
Encryption everywhere
All traffic between your browser, our apps and our APIs is encrypted in transit with TLS. Data is stored on managed database infrastructure with encryption at rest.
Two-factor authentication
Admin accounts support TOTP two-factor authentication using any standard authenticator app, and an organisation can require it of every admin on its account.
Role-based access control
Property admins, front desk staff and residents each get their own application, with permissions scoped to the role. Staff see only what the job requires.
Tenant isolation
Reqzi is multi-tenant by design. Every record is scoped to your organisation, and data from one customer is never visible to another.
Audit trails
Visitors, parcels, service requests and incidents are logged automatically with timestamps. The audit trail you offer your residents is the one we build on.
Payments handled by Stripe
Subscription payments are processed by Stripe, a certified PCI Level 1 service provider. Card details are entered on Stripe-hosted pages and never reach our servers.
UK GDPR and your data
Your data remains yours at all times. We process it only to provide and improve the service you are paying for, in line with UK GDPR.
You can request an export of your organisation's data, or its deletion, at any time. Full details of what we collect and why are in the privacy notice.
What we never do
- Sell personal data, or share it for anyone else's advertising.
- Track visitors across other websites, or run advertising pixels.
- Use your residents' personal data to train a general-purpose AI model.
- Read message content for any purpose other than running the service you bought.
Who else touches your data
The complete list. These services may process data on our behalf, and nothing outside this list does.
| Provider | Purpose | Processes in |
|---|---|---|
| Vercel | Web application hosting | Global edge |
| Railway | API hosting | Europe |
| Supabase | Managed database and file storage | London |
| Stripe | Subscription billing and payments | UK and EU |
| Expo | Mobile app delivery and push notifications | Global |
| HubSpot | Sales enquiries and CRM | EU |
| Cal.com | Demo scheduling | EU |
Reqzi Go runs on its own set, published in its privacy notice.
Bring your security questionnaire
Book a demo and we will work through it on the call, or send it to us and we will fill it in.