Security · last updated 16 November 2026
How MarqueTrack keeps your rent records safe.
Where your data lives, who can reach it, what we check, what we do if something goes wrong, and how to tell us about a problem. Plain words, no certificates we do not hold.
1. Where your data lives
Your records — properties, tenancies, invoices, payments you record, documents — are stored with Supabase in their Singapore region (ap-southeast-1): database, sign-in and file storage. The application itself is delivered by Vercel. Everything travels over HTTPS, and the database and files are encrypted at rest.
Rent never passes through MarqueTrack. Tenants pay you directly, to the PayNow ID or bank details on your invoices. We hold no card numbers and no bank credentials, so there are none to lose.
2. One account cannot see another
Every table in the database is protected by row-level security. Each row belongs to one account, and the database itself refuses to return a row to anyone outside that account — the rule is enforced below the application, so a bug in a screen cannot leak another landlord's records. Uploaded documents sit in a private bucket with the same rule.
Someone who is not signed in gets nothing: the anonymous role can read no records and write none, except an anonymous error report from the sign-in screen so we hear about a broken page.
3. Who can reach it
- You and your team. Owners see everything in the account and manage people; staff see what their role allows. Passwords are hashed by the sign-in service and are never visible to us. On a phone you can add Face ID or a passcode in front of the app.
- Us. Administrative access to the live database is held by the founder only, behind two-factor authentication, and is used to run the service and to help you when you ask. We do not browse client records.
- Nobody else. No third party has a login to your data. The processors below run the infrastructure; they do not use your records.
4. What we check, and how often
- An automated security review runs twice a week against the live service: row-level security on every table, the anonymous role's permissions, database advisories, the security headers the site sends, the dependencies the app is built from, and who has changed the code.
- Security headers on every page: HTTPS is enforced for two years (HSTS), a content-security policy limits what the page may load, and the app cannot be framed by another site.
- Daily platform backups of the database, each kept for 7 days, so records can be restored if something is lost or corrupted. Uploaded documents sit on separate durable storage and are not part of those backups.
- Every change to the product goes through a reviewed pull request before it reaches the live site.
5. If something goes wrong
If we learn of unauthorised access to, or loss or disclosure of, personal data in your account, we will tell you without undue delay and in any event within 72 hours of becoming aware: what happened, what data was affected as far as we know, what we are doing about it, and what we suggest you do. Under the PDPA you are the organisation responsible for your tenants' data and we are your data intermediary; we will help with any assessment or notification you must make to the Personal Data Protection Commission.
6. Who processes data on our behalf
| Provider | What for | Where |
|---|---|---|
| Supabase | Database, sign-in, file storage | Singapore |
| Vercel | Hosting and delivery of the app; cookieless page-view counts on the public site | Global edge network; no personal data in the counts |
| Email delivery provider: Resend | Reminder and alert emails MarqueTrack sends you (sign-up and password emails come from Supabase's sign-in service) | United States, under protection comparable to the PDPA |
| Anthropic (Claude) | Reading a tenant's payment screenshot, only when someone in your account asks for one to be read; helping our team read Tell us messages; answering WhatsApp questions from our approved list of facts, with contact details and names hidden first. Not used to train their models | United States, under protection comparable to the PDPA |
| Stripe | Sending you MarqueTrack's monthly bill and taking its payment (card or PayNow): your billing contact's name and email, and the bill. Never your tenants' data | Singapore (Stripe Payments Singapore) and the United States, under protection comparable to the PDPA |
| Telegram | MarqueTrack's own team chat: a daily summary of how new accounts are getting set up (a client's or agent's name, account name and progress; never tenants' details, amounts or email addresses). A WhatsApp question that needs a person also reaches it, with the first name on the sender's WhatsApp profile and contact details hidden | Outside Singapore |
| Meta (WhatsApp) | Carries your message, only if you write to our WhatsApp line | United States |
| Apple and Google | Delivering push notifications to the phone app, if you turn them on | They receive the notification as shown on your phone (for example a tenant's name and an amount), nothing else |
The same list is in our privacy policy. We add a provider only after checking it can meet these commitments, and we update both pages when we do.
7. Found a problem? Tell us
If you believe you have found a security weakness in MarqueTrack, email max.marquetrack@gmail.com with what you saw and how to reproduce it. We reply within three working days, we will not take action against anyone who reports in good faith and does not access or alter other people's records, and we will tell you when it is fixed. The machine-readable version of this is at /.well-known/security.txt. There is no paid bounty programme.
Contact
Questions about security or personal data, including for our Data Protection Officer: max.marquetrack@gmail.com.