Trust
Security
Last updated September 22, 2026
This page describes what OurHOA does today to protect community records. It does not claim any outside certification or audit.
Each community's data is walled off in the database
OurHOA stores community records in Postgres (hosted by Supabase) with row-level security turned on for community tables. Queries from the app run as the signed-in user, and the database checks that user's active membership in that community before returning or changing a row. A board member in one HOA cannot read another HOA's homes, ledger, documents, or requests, even by editing a URL.
Board and resident access are different
Each membership has a role. Board members and managers can manage homes, members, dues, documents, and settings. Residents see their own home's balance and payment history, community announcements and documents, and the maintenance requests for their home. Board-only records stay board-only, and the resident directory shows a person only if they opt in.
Files are private by default
Documents and maintenance-request photos are stored in private storage buckets. When someone with access opens a file, the server checks their membership and hands out a signed link that expires shortly after (60 seconds for documents). Only documents a board marks public, and published website pages, can be opened without an account.
Stripe handles card and bank details
Dues payments and software subscriptions go through Stripe Checkout. Card numbers and bank account details are entered on Stripe's pages and never touch OurHOA's servers. The ledger records a payment only after Stripe confirms it through a signed webhook, so a browser cannot mark a payment as paid.
Service providers
OurHOA runs on Supabase (database, file storage, sign-in), DigitalOcean (application hosting), Stripe (payments), and Resend (email delivery). When AI features are on, the resident helper sends the question and selected community-document text to OpenAI, and minutes drafting sends the transcript you submit. The privacy policy lists the same providers.
You can take your data with you
A board member can download all community data as a ZIP of CSV files from Community settings at any time, on any plan. The dues ledger also exports to CSV from the Finances page.
Reporting a vulnerability
If you find a security problem, email [email protected] with "Security report" in the subject. Include the steps to reproduce it. Please don't access other communities' data or disrupt the service while testing. We will reply to confirm we got your report.