Security & privacy
How we protect your data
HomeBase is built so your clients, deals and personal details stay yours. Here's every measure we take to keep them safe.
Encryption
Your personal details are protected both in storage and in transit.
- Sensitive profile fields (name, phone, date of birth, address, license and brokerage) are encrypted with AES-256-GCM before they are saved.
- AI assistant chat messages are stored encrypted, never as plain text.
- Every connection to HomeBase is secured with HTTPS/TLS.
Data ownership & isolation
Your contacts, deals and documents belong to you.
- Row-level security means each record can only be read or changed by the agent who owns it.
- Contacts, tasks, leads, reports and messages are isolated from every other agent on the platform.
- Notes stay private unless you choose to publish them.
Account security
Extra checks guard the most sensitive parts of your account.
- Optional two-factor verification can protect documents, signatures, resources, communications and your profile.
- One-time codes are stored only as secure hashes, expire quickly and lock after repeated wrong attempts.
- Unlocks are verified on our servers, not just in your browser.
Secure client links
Links you share with clients are private and short-lived.
- Listing swipe links expire within 48 hours and require the client to verify their email.
- Links are automatically revoked after repeated failed verification attempts.
- Tracked email links only redirect to destinations you actually sent.
Protected systems
Behind the scenes, every service call is checked.
- Every backend action confirms who you are and that you own the data involved.
- Automated jobs and incoming webhooks require secret verification.
- Usage limits on AI tools and text messaging prevent abuse, and sends are audit-logged.
Compliance-minded outreach
We help you contact people responsibly.
- Every system-sent email includes an opt-out link, and opt-outs are honored automatically.
- Phone numbers can be checked against national and state Do Not Call registries.
- Contacts you mark Do Not Contact are blocked across every channel in the app.
Payments
We never see or store your card.
- Checkout is handled entirely by our payment provider.
- Plans are cryptographically signed so they can't be tampered with.
- Every payment event is recorded in your billing history.
Your controls
You decide what happens to your data.
- Delete your account and everything you own at any time from your Profile page.
- Deletion is permanent — records are erased, not archived.
- Terms and privacy acceptance is logged with a hashed IP address, never the raw one.
Questions about your data?
Read our full policies or reach out to our team anytime.