# GDPR Compliant Property Management Software | Security

> GDPR compliant property management software: EU hosting, strict per-account isolation, role-based access, audit trails and a data processing agreement.

- Source: https://real-estate-management.webservices-engineering.de/security
- Language: English (en). Deutsch (de): https://real-estate-management.webservices-engineering.de/de/security · Magyar (hu): https://real-estate-management.webservices-engineering.de/hu/security · Română (ro): https://real-estate-management.webservices-engineering.de/ro/security
- Site: Real Estate Management — The back office for real estate portfolios (Webservices Engineering GmbH)
- Index for machines: https://real-estate-management.webservices-engineering.de/llms.txt
- Every page of this website is also available as Markdown: append `.md` to its URL.

---

## GDPR-compliant property management software: how your data is protected

Tenant names, contracts, meter readings and invoices are personal and financial data. This page states what the system does to protect them, where the data is held, and — just as important — what we do not claim.

- Hosted in the European Union; Private Cloud runs in a dedicated EU data centre
- Every record belongs to an account, and per-account scoping is enforced in the data model
- Role-based access including read-only roles, plus supervised user switching with an audit trail
- No third-party advertising or analytics trackers on this website

- [Request a data processing agreement](https://real-estate-management.webservices-engineering.de/contact)
- [Read the privacy policy](https://real-estate-management.webservices-engineering.de/legal/privacy)

## Who can see what, and how that is proven afterwards

Most real incidents in a property back office are not break-ins. They are the wrong colleague seeing a tenant's contract, or nobody being able to say who changed a figure. Access control and audit trails are built for that.

- **Workspace ID, email, password** — Signing in takes three things: a Workspace ID that identifies the account, an email address and a password. Credentials are only ever valid inside their own workspace, so two customers can use the same email domain without collision.
- **Role-based access control** — Users hold defined roles — admin, supervisor, read-only and a support role. Read-only access exists precisely so owners, accountants and auditors can be given the record without being given the ability to change it.
- **Supervised user switching** — Support staff can act in a user's context to diagnose a problem, and every such switch is supervised and recorded. Help does not require handing over a password, and the trail shows who looked at what.
- **Per-entity security scoping** — Access is scoped at entity level within an account as well as at account level, so visibility of properties, units and contracts follows the structure of the portfolio rather than being all-or-nothing.
- **Audit comments on records** — Records carry comments, so decisions — why an allocation key was changed, why a contract was terminated early — are attached to the object they concern instead of living in someone's mailbox.
- **Per-account SMTP** — Notification and reminder emails to tenants are sent through your own SMTP configuration, from your own domain. Correspondence with data subjects stays inside your mail infrastructure and your own retention rules.

## Isolation is in the data model, not in a filter you can forget

The system is multi-tenant: every record — property, housing unit, room, client, contract, meter, reading, supplier invoice, rebilling entry, document — belongs to an account. That ownership is not decoration. Queries, uniqueness rules and validations are scoped by account, so records from two customers never share a namespace.

The login model reinforces the same boundary. Because a Workspace ID is required to sign in, a user's credentials have no meaning outside their own account. There is no global user directory in which one customer's staff could appear to another's.

Within an account, a further layer applies: multiple legal entities can be kept side by side, so contracts, invoices and revenue belong to the landlord company that actually owns them rather than being pooled.

If shared infrastructure is nevertheless outside your risk appetite, the Private Cloud deployment removes the question entirely by giving your organisation a dedicated single-tenant instance.

- [Inside the Private Cloud deployment](https://real-estate-management.webservices-engineering.de/private-cloud)

## Credentials and outbound connections

The system talks to invoicing platforms and accounting systems on your behalf. That means holding credentials, which is the part that has to be handled carefully.

- **Encrypted credential storage** — Credentials for external platforms are stored encrypted rather than in plain text, so access to a database dump is not the same thing as access to your invoicing or accounting account.
- **Client SSL certificate authentication** — The accounting connector authenticates with client SSL certificates over GraphQL. Both ends of the connection prove who they are; a leaked password alone cannot open a session to the ledger. [What this module does](https://real-estate-management.webservices-engineering.de/solutions/finance-and-accounting)
- **Per-user platform credentials** — Credentials for external platforms are held per user, so invoices are issued under the right person's account on the invoicing platform and the trail on the partner side stays attributable.
- **Outbound by design** — The integration layer calls partner systems; it does not expose your portfolio through a public API surface of its own. There is no open endpoint waiting to be discovered and probed.
- **Invoicing platform integration** — The invoicing platform integration covers document types, numbering scheme prefixes and suffixes and VAT-on-payment. Fiscal documents are created through the platform's own interface, under your credentials.
- **Reviewed before it is added** — The connector layer is designed to take further integrations. Each one is a deliberate piece of engineering with its own authentication model, not a generic webhook opened to anything that asks. [What this module does](https://real-estate-management.webservices-engineering.de/integrations)

## Where the data actually sits

Data residency questions deserve a location, not an adjective.

- **EU hosting** — The Public Cloud service is hosted in the European Union. The Private Cloud deployment runs on dedicated resources in a secure EU data centre reserved for a single customer.
- **Document and asset storage** — Contracts, supplier invoices, cadastral extracts, meter documentation and technical asset files are held in object storage attached to the account, subject to the same per-account scoping as every other record.
- **Backups** — Deployments are backed up regularly. Private Cloud adds dedicated backup and failover infrastructure and disaster recovery on resources that are not shared with any other customer.
- **Backups mirrored to your own site** — On Private Cloud, database and storage backups are mirrored to the client's own site or office, so a copy of the record exists on premises the client controls directly.
- **Monitoring and response** — Private Cloud environments are monitored 24/7 under an SLA of maximum four hours intervention during working hours and twenty-four hours outside them.
- **Processors named in writing** — The processors involved in hosting and storage are named in the data processing agreement rather than described vaguely here. Ask for the document and you get the list.

## Data protection obligations, and who carries them

In almost every deployment you are the controller and we are the processor: the tenant data is yours, we process it to run the service. The paperwork follows that split.

- **Data processing agreement (Auftragsverarbeitungsvertrag)** — A data processing agreement under Article 28 GDPR is available for every account and is provided on request. It covers the subject matter, duration, purpose, categories of data and the processors involved.
- **Data subject rights** — Access, rectification, erasure, restriction, portability and objection. Because tenant data lives in your account, we support you in answering these requests as processor and act on your documented instructions.
- **Storage location on request** — We will tell you where a given deployment is hosted and where its backups are held. On Private Cloud you additionally hold mirrored backups yourself, which simplifies most residency questions.
- **Tenant correspondence stays yours** — Reminder and notification emails go out through your own per-account SMTP configuration, so the messages sent to data subjects originate from your domain and remain in your mail records.
- **Purpose limitation** — Portfolio, contract, meter and invoice data is processed to operate the service you have subscribed to. It is not used to build advertising profiles, and it is not sold or shared for marketing purposes.
- **The formal documents** — The privacy policy, the terms, the cookie information and the imprint are published in full. They are the binding text; this page is the plain-language summary.

## What we claim, and what we do not

Security pages tend to imply more than they promise. This table is here so that a data protection officer can see the boundary without a phone call.

| Statement | Status |
| --- | --- |
| Hosted in the European Union | Claimed |
| Every record scoped to an account, enforced in the data model | Claimed |
| Workspace ID required to sign in; credentials valid only in their workspace | Claimed |
| Role-based access control with read-only roles | Claimed |
| Supervised user switching recorded in an audit trail | Claimed |
| Integration credentials stored encrypted | Claimed |
| Client SSL certificate authentication for the accounting connector | Claimed |
| Per-account SMTP for tenant correspondence | Claimed |
| Regular backups; mirrored to the client's own site on Private Cloud | Claimed |
| Data processing agreement under Article 28 GDPR available | Claimed |
| No third-party advertising or analytics trackers on this website | Claimed |
| ISO 27001 certification | Not claimed. We hold no ISO 27001 certification and do not describe ourselves as certified. |
| SOC 2, ISO 9001 or comparable audit reports | Not claimed. No such attestation exists for this product. |
| Formal penetration test report available on request | Not claimed. We will not imply an artefact we cannot hand over. |
| Uptime percentage guarantee on Public Cloud | Not claimed. A contractual intervention-time SLA exists on Private Cloud; Public Cloud support is best-effort. |

## Not claimed: ISO 27001, SOC 2 or comparable certification

We hold no ISO 27001 certification, no SOC 2 report and no comparable third-party attestation, and we do not describe ourselves as certified. There is no formal penetration test report we can hand over, and there is no uptime percentage guarantee on Public Cloud.

If your procurement process requires a certification we do not hold, tell us early. We would rather lose a deal on the first call than pass an assessment with a claim that does not survive scrutiny.

- [Ask us directly](https://real-estate-management.webservices-engineering.de/contact)

## Nothing on this site is watching you read it

- **No third-party trackers** — There are no third-party advertising or analytics trackers on this website. No ad network pixels, no cross-site behavioural tracking, no session replay.
- **Fonts served from our own infrastructure** — Loading a webfont from a third-party CDN transmits the visitor's IP address to that provider on every page view, which German courts have treated as a data protection problem; we avoid it by not doing it. System and self-hosted fonts only.
- **The whole file, in four documents** — What remains is set out in the cookie information and the privacy policy. If you are evaluating us on behalf of a data protection officer, those two documents plus the data processing agreement are the whole file. [What this module does](https://real-estate-management.webservices-engineering.de/legal/cookies)

## Reporting a vulnerability

If you have found a security issue in the product or on this website, we want the report. Small senior team, no triage bureaucracy — mail reaches the engineers who wrote the code.

1. **Write to us** — Send the report to real-estate-management@webservices-engineering.de with "Security" in the subject line. Include the affected URL or screen, the steps to reproduce, and what an attacker could reach.
2. **Keep it contained** — Please do not access, modify or exfiltrate data belonging to other accounts, do not run denial-of-service or spam tests, and do not use social engineering against staff or customers. Use your own test data.
3. **Give us time to fix it** — We will acknowledge your report and keep you informed while we work on a remedy. Please hold off on public disclosure until a fix is deployed, and tell us if you intend to publish afterwards.
4. **What you can expect** — A human reply, credit if you want it, and honesty about severity and timeline. There is no bug bounty programme and we do not pretend otherwise, but good-faith research is welcome and will not be met with legal threats.

- [Email a security report](mailto:real-estate-management@webservices-engineering.de)

## Asked in every security review

### Is this GDPR-compliant property management software?

The software is built to be operated under GDPR: data is hosted in the European Union, each account's records are strictly isolated, access is role-based with read-only roles available, and a data processing agreement under Article 28 GDPR is provided on request. Compliance is a shared responsibility — you remain the controller for your tenants' personal data.

### Where is our data stored?

Public Cloud is hosted in the European Union. Private Cloud runs on dedicated resources in a secure EU data centre, and its database and document storage backups are additionally mirrored to your own site or office. We will name the hosting location and the processors involved in the data processing agreement on request.

### Do you provide a data processing agreement (Auftragsverarbeitungsvertrag)?

Yes. A data processing agreement under Article 28 GDPR is available for every account and is provided on request before or at the start of the subscription. It sets out the subject matter, duration and purpose of processing, the categories of personal data and data subjects, and the processors involved in hosting and storage.

### Are you ISO 27001 certified?

No. We hold no ISO 27001 certification, no SOC 2 report and no comparable third-party attestation, and we do not describe ourselves as certified. What we do claim is set out explicitly on this page: EU hosting, per-account isolation enforced in the data model, role-based access, audit trails, encrypted integration credentials and regular backups.

### How is one customer's data kept separate from another's?

Every record belongs to an account, and that scoping is enforced in the data model rather than applied as an optional filter. Signing in requires a Workspace ID, so credentials have no meaning outside their own account. Customers who require physical separation as well can take a dedicated single-tenant Private Cloud deployment.

### Does this website track visitors?

No. There are no third-party advertising or analytics trackers, no ad-network pixels and no session replay. Fonts are served from our own infrastructure rather than a third-party CDN, so reading these pages does not transmit your IP address to a font provider. Details are in the cookie information and privacy policy.

- [Where tenant consumption data is processed](https://real-estate-management.webservices-engineering.de/solutions/utility-rebilling)
- [Plans and prices](https://real-estate-management.webservices-engineering.de/pricing)

## Send the assessment questionnaire

If your data protection officer has a checklist, mail it to us and we will answer it line by line — including the lines where the answer is no.

- [Request the data processing agreement](https://real-estate-management.webservices-engineering.de/contact)
- [Compare Public Cloud and Private Cloud](https://real-estate-management.webservices-engineering.de/private-cloud)