Security
Security and data protection
You trust Propnoma with your properties, your owners and your tenants. Here is how that data is stored, who can reach it, and what you can do with it.
Data stored in the EU
Your database and uploaded files — properties, leases, tenants, payments and documents — are stored in the EU (EU West region).
Encrypted in transit and at rest
Every connection uses HTTPS, and data is encrypted at rest in the database and file storage.
Each account sees only its own records
Access is enforced inside the database itself, row by row: a landlord or agency only reaches its own data, a tenant only their own tenancy, and an owner only their own properties. Staff see what their permissions allow — no access, view-only or edit, per area.
Secure sign-in
Strong password rules, passwords stored only as hashes, sessions that expire automatically, and a forced fresh sign-in after a password reset.
Payments handled by Stripe
Card and bank details go straight to Stripe, a PCI DSS Level 1 certified provider — they never touch Propnoma’s servers. Rent goes directly to the landlord’s or agency’s own Stripe account.
Your data stays yours
Export your records as CSV on paid plans. Delete your account at any time and your personal data is removed within 30 days, except records the law requires us to keep.
No ads, no tracking
We never sell data and there are no advertising or tracking cookies. Our public website uses cookie-free, aggregated visit counts; the landlord, agency and tenant apps use no analytics at all.
If something goes wrong
If a security incident affects your data, we will tell you without undue delay, so you can meet your own obligations under GDPR.
GDPR: who is responsible for what
For your own account and billing details, Propnoma (operated by Quorien Shift LLC) is the data controller. For the tenant, owner and property data that landlords and agencies enter, the landlord or agency is the controller, and Propnoma processes that data on their behalf strictly to provide the service.
Need a Data Processing Agreement (DPA) for your agency? Email us at privacy@propnoma.com
Sub-processors
To deliver our secure cloud infrastructure, we work with a select number of specialised third-party sub-processors. Every infrastructure provider we use is bound by a strict Data Processing Agreement (DPA) and, where data leaves the European Economic Area (EEA), by Standard Contractual Clauses approved by the European Commission.
We use sub-processors in the following categories:
- Cloud infrastructure & secure database hosting (primary storage in the European Union)
- User authentication & identity security
- Application hosting, content delivery & network security
- Transactional email & automated notifications
- Subscription billing (Merchant of Record) & payment processing, including online rent payments
- AI document reading (supplier bills scanned in the app)
The full list of sub-processor names and locations is included in our Data Processing Agreement (DPA), available to registered agencies and business customers on request at privacy@propnoma.com
Customers with a DPA are notified before we add or replace a sub-processor.
Report a security issue
Found a vulnerability? Please tell us privately and give us a chance to fix it before sharing it. Email security@propnoma.com