1. Secure connections
The production RentReturn website uses HTTPS to protect browser traffic in transit.
The audited production site also sends HTTP Strict Transport Security (HSTS), which instructs supporting browsers to use HTTPS.
A dedicated server-side database pathway used for certain tax-statement operations requires an encrypted database connection.
These facts do not mean that every possible internal provider path or external copy is covered by the same control.
2. Account access
RentReturn currently uses email/password authentication provided through Supabase.
Authenticated RentReturn pages verify that a user is signed in before allowing access to the application.
RentReturn does not currently provide customer-facing multi-factor authentication.
3. Database access controls
RentReturn uses PostgreSQL Row Level Security on its live customer-data tables.
The audited database had RLS enabled across the live public application tables, with policies that generally tie access to the authenticated account and related records.
Some trusted server/provider roles necessarily have broader technical authority than an ordinary signed-in user. RLS should therefore be understood as an application/database access control, not a guarantee that no authorised operational or provider access can ever occur.
4. Supporting documents
Supporting evidence is stored in a private Supabase Storage bucket rather than as publicly accessible files.
RentReturn checks the authenticated user and related record before issuing a document download. Current application downloads use time-limited signed links.
This does not mean uploaded files are malware-scanned or that every deleted record automatically erases every possible underlying storage object or backup. Those wider guarantees are not currently made.
5. Hosting and infrastructure
RentReturn currently uses:
- Supabase for its database, authentication and private document storage;
- Vercel for application hosting and server/runtime infrastructure.
The current Supabase project is primarily configured in Ireland. The current Vercel function region is in the United States.
These are primary configuration locations, not a statement that every provider, log, support system or subprocessor operates only in those locations.
RentReturn must not be described as UK-only hosted or UK-only processed.
6. Encryption at rest
Supabase states that customer data in its hosted service is encrypted at rest, and Vercel states that on-disk data in its infrastructure is encrypted at rest.
We rely on those provider controls for the relevant hosted services.
We do not claim that every copy of RentReturn data, browser session, temporary process, log, backup, downloaded export or externally shared file is covered by one universal encryption-at-rest guarantee.
7. Account and record isolation
RentReturn's application data model is account scoped.
Database policies, server-side checks and private storage access rules are used to restrict ordinary customer access to records associated with the authenticated account.
We do not claim that these controls make unauthorised access impossible.
8. Internal and provider access
Our intended operating policy is that customer data is accessed internally only by specifically authorised people where reasonably necessary for support, maintenance, security or operation of the service.
Supabase and Vercel also operate privileged infrastructure as service providers.
9. Logs and diagnostics
RentReturn and its providers create technical logs and diagnostic information needed to operate and troubleshoot the service.
The application also maintains certain business/audit history records.
We do not currently claim 24/7 security monitoring, a fixed incident-response time, or a universal log-retention period.
10. Backups and recovery
The current audits did not establish a project-specific database backup/PITR guarantee, a verified backup mechanism for uploaded Storage object bytes, or a tested RentReturn recovery target.
RentReturn therefore does not currently make a public promise about backup frequency, recovery point, recovery time or guaranteed restoration.
11. Security testing
RentReturn has security-focused automated tests and static checks in its development repository.
The audits did not establish a recurring production security-testing programme, penetration-test programme or certification.
We therefore do not claim regular penetration testing, ISO 27001, Cyber Essentials, PCI DSS or another certification unless it is later independently established.
12. What you can do
You can help protect your RentReturn account by:
- using a strong, unique password;
- not sharing your sign-in details;
- protecting access to your email account;
- signing out on shared or public devices;
- contacting us if you believe your account or data may have been compromised.
13. Reporting a security concern
If you believe you have found a security issue affecting RentReturn, contact:
security@rentreturn.co.uk
Please do not include passwords, authentication tokens or unnecessary customer information in your initial report.
14. Privacy
Our Privacy Notice explains how RentReturn handles personal information, including service providers, international processing, retention and your rights.
See /privacy.
15. Changes to this page
We will update this page when our security controls or infrastructure materially change.
Security statements should be reviewed against the actual deployed system before each material publication update.