Trust
This is the page to drop into a vendor-review response. It explains how PropSocket isolates your data, how we encrypt it, how we handle the credentials you give us, how we sign the webhooks we send you, and exactly where our compliance posture stands today — including what is still in progress. Written for the person who has to close a security questionnaire, not for a sales call.
Last reviewed: 2026-07-11
PropSocket is multi-tenant: many customers run on the same infrastructure, but your data is scoped to your Organization. Every request — whether it comes through our API, our dashboard, or an internal support tool — is filtered by your Organization before any data is returned. No other PropSocket customer can query, see, or export your data.
This isolation is not a setting you turn on and it is not a plan feature. It is enforced on every read and every write as a built-in rule of the platform. A request that is not scoped to an Organization does not run.
Your data is encrypted in transit and at rest. Every connection to PropSocket uses TLS 1.2 or higher. The data we store — including the property-management data we sync from your PMS — is encrypted at rest in our database and storage.
To sync your data, PropSocket stores the credentials you provide for your Property Management System — for example, your Entrata API user. We treat those credentials as the most sensitive thing you hand us: they areencrypted at rest; after you enter them they are never displayed backin plain text — not in the dashboard, not in our support tools (a credential can be replaced but never read back); and if youremove an integration, the stored credentials are permanently deleted immediately.
User sign-in is handled by WorkOS, our authentication provider. Multi-factor authentication (MFA) is available to every customer on every plan as a standard part of sign-in — not a paid add-on. SAML single sign-on (SSO), which lets your team sign in through your own identity provider with the credentials they already manage, is available on our Enterprise plan.
When PropSocket notifies your systems that your data changed, we send a webhook — and once you've set a signing secret, every message is signed. Each signed webhook carries an HMAC-SHA256 signature in theX-PropSocket-Signature header. Your team verifies that signature to confirm two things: the message genuinely came from PropSocket, and it was not altered in transit. The signing secret is yours, and you can rotate it at any time. We recommend setting a signing secret on every webhook subscription.
OurSOC 2 Type II audit is in progress. We've signed a letter of engagement with an independent audit firm and we're in the ~3-month observation period, with our report expected in Q4 2026. We monitor our controls continuously with Vanta. Once the audit completes, we expect to make the Type II report available to customers under NDA on request; today we're happy to share our audit scope and walk you through our current security posture. Our Trust Center reflects where we stand.
For the data PropSocket syncs from your PMS, PropSocket acts as adata processor and you act as thedata controller. You decide what data flows into PropSocket and why; we process it on your instructions to provide the service.
We support your GDPR and CCPA obligations by honoring verified deletion requests within 30 days (seeData handling & retention), limiting what we store to the data your PMS exposes and never storing a full Social Security Number, and maintaining a current subprocessor list with change notifications.
Data Processing Agreement (DPA).PropSocket provides a DPA that defines our role as processor, your role as controller, our security and confidentiality commitments, our subprocessor terms, and how we handle data-subject and deletion requests.The DPA is available on request — contact us through the Trust Center or at the address below.
PropSocket relies on a small set of third-party services to run the platform — for hosting, authentication, and monitoring. We keep the full, current list in our Trust Center, and you can subscribe there to be notified when it changes.
One set of retention windows applies to every customer on every plan — retention is not a paid upgrade.
| Data | How long we keep it |
|---|---|
| Your property-management records Property, Unit, Resident, Lease, Lease-Resident | Life of your contract, plus 30 days after cancellation, then permanently deleted (swept daily) |
| Sync logs | 90 days, rolling |
| Webhook delivery logs | 30 days, rolling |
| Operational request logs | 30 days (up to 90 in larger environments) |
| Administrative audit records | Retained internally; we can provide audit records to your team on request |
| Your PMS credentials | Encrypted at rest; permanently deleted immediately when you remove the integration |
| Backups | Encrypted automated backups, aged out on a rolling basis |
Deleted data may persist in our encrypted backups until they age out on a rolling basis — this applies to every row above, including hard-deletion requests. For the full narrative — soft delete vs. hard delete, off-boarding, and the webhook recall limit — seeData handling & retention.
For the deeper data narrative, seeData handling & retention. To relay a resident's data-subject request, seeData subject requests. To report a security issue, seeVulnerability disclosure. For our audit status, the subprocessor list, and the DPA, visit theTrust Center.
If your security or compliance team needs something this page doesn't cover, emailprivacy@propsocket.iofor data-handling and deletion questions, or use ourcontact pagefor anything else. A real person will reply within one business day.
Send your questionnaire our way. We answer the real questions with real numbers — including the ones still in progress — and put a person on the other end, not a form. Expect a reply within one business day.