What we hold, and who can reach it.
When a board member signs in from a phone at an annual meeting, the session reaches that community's records and nothing else. The scope is enforced in the database on every request, not by the screen they're looking at. Here is each control and what it covers.
You
Board · Community manager · Vendor
TLS 1.3
Encrypted in transit
Scoped access
Role + row-level security
AES-256
Encrypted at rest
Verified actions
Server-validated payouts
How your data is protected
Every request runs the same checks, from the browser to the payout.
6 controls behind those layers.
Encryption
All data is encrypted in transit using TLS 1.3 and at rest using AES-256 encryption via our infrastructure partners.
Role-Based Access
A community manager sees only their own communities. A vendor sees only the work orders it was awarded. Admin access is limited.
Server-Validated Actions
Work order approvals and payouts are validated on the server. Database access is scoped with row-level security, and a payment record is kept for every transaction. Roles, vetting decisions and insurance status are written to an audit log the database itself refuses to edit or delete.
Infrastructure
Hosted on Vercel with Supabase (AWS) providing managed database and authentication services.
Authentication
Secure authentication via Supabase Auth using email/password and magic-link sign-in, with session-based token management.
Compliance Verification
A person reads each vendor insurance document and files what it says. The expiration date is recorded, and coverage nearing its end is flagged for review.
Named, not graded.
A check on this platform is a document with a date on it. Somebody at HOAcrew reads the certificate, records what it says rather than what was typed, and proposals close when the date passes.
What closes a proposal
- General liabilityRequired in every trade before a company can propose. A 30-day renewal window, then proposals close.
- Workers’ compensationRequired in every trade before a company can propose. A 30-day renewal window, then proposals close.
- The credential the trade requiresA CPO card for pool, auto liability for landscaping and a background check for porter and amenity staffing. Auto liability carries the 30-day insurance window; a competency certificate carries none, because an expired one is not a certificate.
A staffing company offering lifeguards adds a fourth — a lifeguard certification, gated on its own.
On file, and closing nothing
- Business registrationBusiness registration is collected and verified too, and it sits on file rather than deciding a proposal.
- W-9A W-9 is collected and verified in the same review.
A person at HOAcrew reads the certificate itself, records what the document says rather than what was typed, and records the date it runs out. Because a document check is not a review of anybody's work, the vendors propose and your management team selects the one it wants.
Read a certificate yourselfFound something? Tell us.
If you discover a security vulnerability, please report it responsibly to security@hoacrew.com. Every report is read by a person and acknowledged.
Email the security inbox