How We Keep Your Data Safe

Where your data lives

Your records (buildings, units, tenants, calls, messages, work orders) are kept in a managed Postgres database on Amazon Web Services in the United States (US West, Oregon).
The console you sign in to runs on Amazon Web Services in the United States (US East, Ohio).
Calls and texts are carried by our phone providers, Vapi and Twilio. Emails go through Google. Behind-the-scenes steps run on a cloud automation service, n8n.
Everything travels encrypted. Every connection to the console and between our services uses HTTPS. Your data is also encrypted where it is stored.

Only your company. Every record is tied to your company, and your logins can only ever see your own company.
You decide what each person can do. The owner of your account gives each login its own permissions, and can switch any login off.
At REIGN, only our admin login can open your console, to set you up and to fix problems you ask us to fix.
Every change is written down with who made it and when, on the Changes page.
Your property software stays untouched. When you connect AppFolio or another system, you give read-only access. Winston reads. It never writes back.

We never store your password. Only a scrambled version is kept (salted PBKDF2 with SHA-256, 120,000 rounds), so nobody can read it, us included.
Strong passwords are required: 8 to 30 characters, upper and lower case letters, a number and a sign, and no easy runs like 123 or abc. Your last 3 passwords cannot be used again.
Guessing is blocked. After 10 wrong tries in 15 minutes, that email address and that network are locked out for a while.
Sign-ins expire. A sign-in lasts at most 12 hours, and the console signs you out when nobody is using it. The sign-in cookie is secure and cannot be read by other websites or scripts.

A full copy of all data every day, kept for 14 days.
Rewind to any minute in the last 7 days, if something is changed or removed by mistake.
Uploads never wipe anything. A blank cell in a file is ignored, and a field your team changed by hand is protected from later uploads.

Your calls still get answered by a person. If our phone system ever has a problem, calls to your Winston line ring your backup number instead of failing. You set that number in the console under Emergencies.
Nothing fails quietly. Anything Winston could not send or finish shows up in your daily summary marked as needing a person.
We tell you. If anything ever goes wrong with your data, we tell you in writing within 72 hours of finding out, with what happened and what we are doing about it.

Your logins are switched off on the day you cancel.
Ask within 30 days and we send you a full export of your data.
90 days after you cancel, your data is deleted.
While you are a client, you can download any report as a spreadsheet at any time.