Your estate’s data, locked down.
Residents trust their estate with their homes, visitors and payments. Here is exactly how we protect that data.
Built secure by design.
Encryption in transit
All traffic between the apps and our servers runs over HTTPS (TLS), so data is encrypted in transit.
Password hashing
Passwords are hashed with bcrypt at cost factor 12. We never store plaintext passwords.
Short-lived tokens
Access tokens expire after 15 minutes. Refresh tokens are checked server-side and revoked on sign-out or password change.
Estate isolation
Every record is scoped to a single estate. No cross-estate access is possible.
Role-based access
Managers, guards and residents only see what their role needs — enforced on the server, not just in the app.
Responsible disclosure
Found a vulnerability? Report it privately and we’ll work with you to fix it.
Trusted providers, end to end.
The services that run AreaConnect — and what each one is responsible for.
The AreaConnect API runs on Railway, and our web apps are served over HTTPS from a global CDN. Security headers are applied to every API response.
Resident and estate data is stored in MongoDB Atlas, a managed cloud database with encrypted connections.
Card and bank details are handled exclusively by Paystack, a PCI DSS Level 1 certified processor. We never see or store card numbers.
Transactional emails are delivered via Resend with DKIM and SPF authentication to prevent spoofing.
Services are health-checked and restart automatically on failure.
The Guard app keeps verifying visitors offline and syncs once the connection returns.
Standards we work to.
We handle personal data in line with the Nigerian Data Protection Act 2023 — only what each feature needs, never sold.
Payment processing is handled by Paystack, which is PCI DSS Level 1 certified.
All traffic to and from AreaConnect is encrypted in transit.
Found a vulnerability?
- We acknowledge reports as quickly as we can
- We investigate promptly and thoroughly
- We fix confirmed issues in a timely manner
- No legal action against good-faith researchers
Email the details, including steps to reproduce. Please don’t disclose publicly until we’ve had a chance to fix it.
Report a vulnerabilityRead our Privacy Policy