GDPR Compliant Property Management Software

Access control

Who can see what, and how that is proven afterwards

Most real incidents in a property back office are not break-ins. They are the wrong colleague seeing a tenant's contract, or nobody being able to say who changed a figure. Access control and audit trails are built for that.

Workspace ID, email, password

Signing in takes three things: a Workspace ID that identifies the account, an email address and a password. Credentials are only ever valid inside their own workspace, so two customers can use the same email domain without collision.

Role-based access control

Users hold defined roles — admin, supervisor, read-only and a support role. Read-only access exists precisely so owners, accountants and auditors can be given the record without being given the ability to change it.

Supervised user switching

Support staff can act in a user's context to diagnose a problem, and every such switch is supervised and recorded. Help does not require handing over a password, and the trail shows who looked at what.

Per-entity security scoping

Access is scoped at entity level within an account as well as at account level, so visibility of properties, units and contracts follows the structure of the portfolio rather than being all-or-nothing.

Audit comments on records

Records carry comments, so decisions — why an allocation key was changed, why a contract was terminated early — are attached to the object they concern instead of living in someone's mailbox.

Per-account SMTP

Notification and reminder emails to tenants are sent through your own SMTP configuration, from your own domain. Correspondence with data subjects stays inside your mail infrastructure and your own retention rules.

Tenancy model

Isolation is in the data model, not in a filter you can forget

The system is multi-tenant: every record — property, housing unit, room, client, contract, meter, reading, supplier invoice, rebilling entry, document — belongs to an account. That ownership is not decoration. Queries, uniqueness rules and validations are scoped by account, so records from two customers never share a namespace.

The login model reinforces the same boundary. Because a Workspace ID is required to sign in, a user's credentials have no meaning outside their own account. There is no global user directory in which one customer's staff could appear to another's.

Within an account, a further layer applies: multiple legal entities can be kept side by side, so contracts, invoices and revenue belong to the landlord company that actually owns them rather than being pooled.

If shared infrastructure is nevertheless outside your risk appetite, the Private Cloud deployment removes the question entirely by giving your organisation a dedicated single-tenant instance.

Inside the Private Cloud deployment

Integrations

Credentials and outbound connections

The system talks to invoicing platforms and accounting systems on your behalf. That means holding credentials, which is the part that has to be handled carefully.

Encrypted credential storage

Credentials for external platforms are stored encrypted rather than in plain text, so access to a database dump is not the same thing as access to your invoicing or accounting account.

Client SSL certificate authentication

The accounting connector authenticates with client SSL certificates over GraphQL. Both ends of the connection prove who they are; a leaked password alone cannot open a session to the ledger.

Per-user platform credentials

Credentials for external platforms are held per user, so invoices are issued under the right person's account on the invoicing platform and the trail on the partner side stays attributable.

Outbound by design

The integration layer calls partner systems; it does not expose your portfolio through a public API surface of its own. There is no open endpoint waiting to be discovered and probed.

Invoicing platform integration

The invoicing platform integration covers document types, numbering scheme prefixes and suffixes and VAT-on-payment. Fiscal documents are created through the platform's own interface, under your credentials.

Reviewed before it is added

The connector layer is designed to take further integrations. Each one is a deliberate piece of engineering with its own authentication model, not a generic webhook opened to anything that asks.

Hosting and storage

Where the data actually sits

Data residency questions deserve a location, not an adjective.

EU hosting — The Public Cloud service is hosted in the European Union. The Private Cloud deployment runs on dedicated resources in a secure EU data centre reserved for a single customer.
Document and asset storage — Contracts, supplier invoices, cadastral extracts, meter documentation and technical asset files are held in object storage attached to the account, subject to the same per-account scoping as every other record.
Backups — Deployments are backed up regularly. Private Cloud adds dedicated backup and failover infrastructure and disaster recovery on resources that are not shared with any other customer.
Backups mirrored to your own site — On Private Cloud, database and storage backups are mirrored to the client's own site or office, so a copy of the record exists on premises the client controls directly.
Monitoring and response — Private Cloud environments are monitored 24/7 under an SLA of maximum four hours intervention during working hours and twenty-four hours outside them.
Processors named in writing — The processors involved in hosting and storage are named in the data processing agreement rather than described vaguely here. Ask for the document and you get the list.

GDPR

In almost every deployment you are the controller and we are the processor: the tenant data is yours, we process it to run the service. The paperwork follows that split.

Data processing agreement (Auftragsverarbeitungsvertrag) — A data processing agreement under Article 28 GDPR is available for every account and is provided on request. It covers the subject matter, duration, purpose, categories of data and the processors involved.
Data subject rights — Access, rectification, erasure, restriction, portability and objection. Because tenant data lives in your account, we support you in answering these requests as processor and act on your documented instructions.
Storage location on request — We will tell you where a given deployment is hosted and where its backups are held. On Private Cloud you additionally hold mirrored backups yourself, which simplifies most residency questions.
Tenant correspondence stays yours — Reminder and notification emails go out through your own per-account SMTP configuration, so the messages sent to data subjects originate from your domain and remain in your mail records.
Purpose limitation — Portfolio, contract, meter and invoice data is processed to operate the service you have subscribed to. It is not used to build advertising profiles, and it is not sold or shared for marketing purposes.
The formal documents — The privacy policy, the terms, the cookie information and the imprint are published in full. They are the binding text; this page is the plain-language summary.

Candour

What we claim, and what we do not

Security pages tend to imply more than they promise. This table is here so that a data protection officer can see the boundary without a phone call.

Statement	Status
Hosted in the European Union	Claimed
Every record scoped to an account, enforced in the data model	Claimed
Workspace ID required to sign in; credentials valid only in their workspace	Claimed
Role-based access control with read-only roles	Claimed
Supervised user switching recorded in an audit trail	Claimed
Integration credentials stored encrypted	Claimed
Client SSL certificate authentication for the accounting connector	Claimed
Per-account SMTP for tenant correspondence	Claimed
Regular backups; mirrored to the client's own site on Private Cloud	Claimed
Data processing agreement under Article 28 GDPR available	Claimed
No third-party advertising or analytics trackers on this website	Claimed
ISO 27001 certification	Not claimed. We hold no ISO 27001 certification and do not describe ourselves as certified.
SOC 2, ISO 9001 or comparable audit reports	Not claimed. No such attestation exists for this product.
Formal penetration test report available on request	Not claimed. We will not imply an artefact we cannot hand over.
Uptime percentage guarantee on Public Cloud	Not claimed. A contractual intervention-time SLA exists on Private Cloud; Public Cloud support is best-effort.

Not claimed: ISO 27001, SOC 2 or comparable certification

We hold no ISO 27001 certification, no SOC 2 report and no comparable third-party attestation, and we do not describe ourselves as certified. There is no formal penetration test report we can hand over, and there is no uptime percentage guarantee on Public Cloud.

If your procurement process requires a certification we do not hold, tell us early. We would rather lose a deal on the first call than pass an assessment with a claim that does not survive scrutiny.

Ask us directly

This website

Nothing on this site is watching you read it

No third-party trackers

There are no third-party advertising or analytics trackers on this website. No ad network pixels, no cross-site behavioural tracking, no session replay.

Fonts served from our own infrastructure

Loading a webfont from a third-party CDN transmits the visitor's IP address to that provider on every page view, which German courts have treated as a data protection problem; we avoid it by not doing it. System and self-hosted fonts only.

The whole file, in four documents

What remains is set out in the cookie information and the privacy policy. If you are evaluating us on behalf of a data protection officer, those two documents plus the data processing agreement are the whole file.

Responsible disclosure

Reporting a vulnerability

If you have found a security issue in the product or on this website, we want the report. Small senior team, no triage bureaucracy — mail reaches the engineers who wrote the code.

Write to us

Send the report to real-estate-management@webservices-engineering.de with "Security" in the subject line. Include the affected URL or screen, the steps to reproduce, and what an attacker could reach.
Keep it contained

Please do not access, modify or exfiltrate data belonging to other accounts, do not run denial-of-service or spam tests, and do not use social engineering against staff or customers. Use your own test data.
Give us time to fix it

We will acknowledge your report and keep you informed while we work on a remedy. Please hold off on public disclosure until a fix is deployed, and tell us if you intend to publish afterwards.
What you can expect

A human reply, credit if you want it, and honesty about severity and timeline. There is no bug bounty programme and we do not pretend otherwise, but good-faith research is welcome and will not be met with legal threats.

Email a security report

Questions

Asked in every security review

Is this GDPR-compliant property management software?

The software is built to be operated under GDPR: data is hosted in the European Union, each account's records are strictly isolated, access is role-based with read-only roles available, and a data processing agreement under Article 28 GDPR is provided on request. Compliance is a shared responsibility — you remain the controller for your tenants' personal data.

Where is our data stored?

Public Cloud is hosted in the European Union. Private Cloud runs on dedicated resources in a secure EU data centre, and its database and document storage backups are additionally mirrored to your own site or office. We will name the hosting location and the processors involved in the data processing agreement on request.

Do you provide a data processing agreement (Auftragsverarbeitungsvertrag)?

Yes. A data processing agreement under Article 28 GDPR is available for every account and is provided on request before or at the start of the subscription. It sets out the subject matter, duration and purpose of processing, the categories of personal data and data subjects, and the processors involved in hosting and storage.

Are you ISO 27001 certified?

No. We hold no ISO 27001 certification, no SOC 2 report and no comparable third-party attestation, and we do not describe ourselves as certified. What we do claim is set out explicitly on this page: EU hosting, per-account isolation enforced in the data model, role-based access, audit trails, encrypted integration credentials and regular backups.

How is one customer's data kept separate from another's?

Every record belongs to an account, and that scoping is enforced in the data model rather than applied as an optional filter. Signing in requires a Workspace ID, so credentials have no meaning outside their own account. Customers who require physical separation as well can take a dedicated single-tenant Private Cloud deployment.

Does this website track visitors?

No. There are no third-party advertising or analytics trackers, no ad-network pixels and no session replay. Fonts are served from our own infrastructure rather than a third-party CDN, so reading these pages does not transmit your IP address to a font provider. Details are in the cookie information and privacy policy.

Where tenant consumption data is processed Plans and prices

Next step

Send the assessment questionnaire

If your data protection officer has a checklist, mail it to us and we will answer it line by line — including the lines where the answer is no.

Request the data processing agreement Compare Public Cloud and Private Cloud

GDPR-compliant property management software: how your data is protected