Last updated: September 12, 2026
Operators trust RentalPilot with their customers’ personal data and their business records. This page summarizes how we protect it. It is a summary, not a warranty — the binding commitments are in our Terms of Service and Data Processing Addendum.
1. Encryption
All traffic to and from the service is encrypted in transit with TLS. Data is encrypted at rest in our hosting and object-storage environments.
2. Payments
Card payments run through Stripe, a PCI-DSS Level 1 certified provider, using Stripe Elements. Card numbers are captured directly by Stripe in the browser — RentalPilot never sees or stores a full card number. We store only Stripe tokens and identifiers.
3. Accounts and access
- Passwords are stored only as salted hashes, never in plain text.
- Two-factor authentication is available for operator accounts.
- Staff accounts have role-based permissions and can be scoped to a single branch.
- Sessions use signed, HTTP-only cookies and can be revoked.
- Every operator’s data is scoped to their own tenant, enforced server-side on each request.
4. Application security
- Security headers and a content-security policy on the web front end.
- Rate limiting on authentication and public endpoints to limit brute-force and abuse.
- Uploaded files are validated by content inspection, not just by file extension.
- Changes to the operator application and API pass automated dependency auditing and secret scanning in continuous integration before they can be merged.
5. Infrastructure and availability
We host on managed cloud infrastructure (see our sub-processors) with managed database backups. Access to production systems is limited to authorized personnel and protected by strong authentication.
6. Data retention and deletion
Operators can export their data at any time, and the product includes tools to export or erase an individual renter’s personal data to support data-subject requests. Sensitive renter media such as license images is subject to an automatic retention period, after which it is deleted while transactional and financial records are retained for legal and accounting purposes.
7. Where we are today
We believe in being straight about this: RentalPilot is an independent product and we have not yet completed an independent third-party audit such as SOC 2. The controls described above are real and in place today; a formal audit is something we intend to pursue as we grow. If your procurement process requires specific evidence, contact us and we will tell you honestly what we can and cannot provide.
8. Reporting a vulnerability
If you believe you have found a security issue, please report it to info@rentalpilot.io with enough detail to reproduce it. We welcome good-faith security research, will acknowledge your report, and will not pursue action against researchers who act responsibly: report promptly, avoid privacy violations and service degradation, and give us reasonable time to fix the issue before disclosing it publicly.