How we protect your data

Every connection to hoabase.io is encrypted. Plain HTTP requests are redirected to HTTPS, and our edge requires TLS 1.2 or newer, so older, weaker protocols are refused.

The database that holds your community’s records and the storage that holds your documents are both encrypted at rest with AWS-managed keys. Our account audit logs are stored in a separate bucket that is also encrypted at rest.

HOABase runs on Amazon Web Services, in data centers in the United States. Your community’s records, documents, and uploads are stored there and nowhere else.

Documents are stored in a private Amazon S3 bucket under your community’s own folder. Public access to the bucket is blocked, and the paths that hold community data are refused at our edge. The only way to download a document is through a short-lived, signed link issued by our API to a signed-in user who is allowed to see it.

Sign-in is handled by Amazon Cognito. Passwords must be at least 8 characters with a mix of upper- and lower-case letters and a number, and we never see or store them in plain text.

Access is role-based. Each person is a manager, a board member, or a resident of a specific community, and every API request checks that role against that community before returning anything. A resident sees their own account and the community materials shared with them; board members and managers see the community’s records; nobody sees another community’s data.

Your HOABase subscription is billed through Stripe. Checkout happens on a page Stripe hosts, so card numbers never touch our servers. The credentials we use to talk to Stripe are kept in AWS Secrets Manager, not in our code.

Resident dues work differently: residents pay through your association’s own payment link. HOABase records the balance and sends the reminders, but never holds or moves dues money.

The database has continuous backups (point-in-time recovery) turned on, so it can be restored to a specific moment rather than only to a nightly snapshot.

The document bucket is versioned. When a file is overwritten or deleted, the previous version is kept for 90 days before it is purged.

AWS CloudTrail records administrative activity across our whole account, in every region, with log-file validation turned on so the record cannot be altered without detection. Those logs are kept in a private, encrypted bucket for one year, and we keep a written incident-response plan that relies on them.

Our site analytics are first-party and cookie-free: page views are counted with a random, anonymous identifier and no personal data.

Your association owns its data. Our Privacy Policy explains what we collect and why, and our Data Processing Agreement sets out the terms under which we handle personal data on your community’s behalf.

Bulk-import spreadsheets are deleted automatically 180 days after upload, since they are only needed until the import finishes. To request deletion of an account or a community’s data, email owner@tisacrest.com.

If you believe you have found a security problem, or you have a question this page does not answer, email owner@tisacrest.com with the subject “Security”. A person reads every message.