Home / Security
Security & Trust
A trust product, secured like one.
Merit handles people's homes and money. So security isn't a feature we bolted on; it's how the whole thing is built, from the database up.
Secure by construction
The rules we never break.
A small set of principles, applied to every part of the product.
Isolation by the database
The database itself enforces who can see what · not the app. You can only ever touch data from a tenancy you're a party to.
Powerful keys stay server-side
The browser only ever holds a safe, public key. The keys that can override protections live only in our servers · never in your device.
Least privilege everywhere
Landlords and tenants get exactly what they need and nothing more. Files live in private storage and are served only via short-lived signed links.
Append-only record
Evidentiary data is never edited or deleted in place. Corrections and "unsends" are new entries, so the history always stays whole.
Validated on the server
We never trust the browser. Every action is checked for shape and permission server-side before it touches the record.
Managed, verified auth
HTTPS only, verified email, and sessions handled by a hardened, managed auth system. We don't roll our own.
A gate before money
Nothing touches real payments until it passes a dedicated security and legal review. Trust is earned before it's monetized.
You own your data
Export the full record anytime, in open formats, and verify it yourself. No lock-in, no black box, no "trust us."
Tamper-evidence
Don't trust us. Verify the record.
The strongest security promise is one you can check yourself. Every consequential action is hashed and linked into a chain · so if a single entry were ever altered, the proof would break, visibly.
Every event is fingerprinted
Each action gets a cryptographic hash of its contents, bound to the moment it happened.
Each links to the last
Events are chained together, so the order and contents can't be quietly rewritten.
Anyone can re-check it
Export the record and re-run the verification. A valid chain means nothing was changed.
Where we are
An honest snapshot of our posture.
We'd rather tell you exactly where we stand than hide behind logos.
Security-first architecture
Row-level security, encryption, and an append-only record are built in from day one. Formal certifications like SOC 2 are on our roadmap as we grow · we'll share them when they're earned, not before.
Encryption by default
Data is encrypted in transit and at rest, with private storage and signed-link access for every file.
Responsible disclosure
Found something? We want to hear from you. Reach out through our contact form and we'll respond quickly.
Proof you can both trust
See the security for yourself.
In a demo, we'll export a real record and let you verify the chain, the same way your tenants can.
No credit card · No pressure