1. Our Approach
1.1 We maintain technical and organisational measures designed to protect Customer Data against unauthorised access, loss and alteration. This page describes them. It forms part of our Terms of Service, and words with capitals have the meanings given there.
1.2 No system is completely secure. We review and improve these measures over time, and may change them, provided that the protection they give is not materially reduced.
2. Separation of Each Company's Data
2.1 Every record belongs to one company, and each company's data is kept separate from every other company's, so that no company's users can see or change another company's data. Automated tests check this separation, and each user's permissions, before any change to the Service is released.
3. Encryption
- Connections between your browser and the Service are encrypted.
- CNIC, NICOP and passport numbers, owners' bank details and rental applications are stored encrypted.
- ID card and passport photos are stored encrypted and kept private.
- Every backup is encrypted.
4. Access Within the Customer's Company
- Administrators decide what each Authorised User can see and do, for the whole company or only for chosen properties.
- Lists show only the last 4 digits of a CNIC, NICOP or passport number. Seeing the full number is a separate permission, and every full view is recorded.
- ID card and passport photos open only for people allowed to see them, and every view is recorded. They are never shared to the tenant portal.
- Owner reports never show tenants' ID numbers.
- Removing a person's access ends their sessions in that company at once.
5. Signing In
- Passwords are stored in a form that cannot be read back, by anyone, including us.
- Any Authorised User can turn on two-step verification, with a code from an authenticator app at every sign-in. We recommend it for every Administrator.
- Sensitive steps, such as downloading a backup or a complete archive, ask the person to prove who they are again.
- Repeated wrong passwords or codes lock the login for a period.
- Sessions expire, and can be ended.
6. Activity Log
6.1 Every change, sign-in and sensitive view is recorded in an activity log that cannot be edited, with who did it and when.
7. Our Personnel
7.1 Our staff use a separate console, with its own sign-in and two-step verification required. Every action taken in it is recorded.
7.2 When and how our personnel may access Customer Data is set out on our Support Access page.
8. SaabAI
- SaabAI reads and changes records only through the same checks as the screens, with the permissions of the person asking. It cannot see or do anything that person could not.
- No change is made until the person confirms it, and each confirmed change is recorded in the activity log as theirs, marked as made through SaabAI.
- SaabAI never sees full CNIC, NICOP or passport numbers, and cannot reach sign-in, users and permissions, billing, backups or data exports.
9. Payments
9.1 Subscription payments made online are taken on a third-party payment processor's secure hosted page. Card numbers, security codes and wallet details never reach RentSaab.
10. Uploaded Files
10.1 Every file uploaded to the Service is checked for viruses before it is saved. A file that appears unsafe is refused.
11. Shared Links
11.1 Links to statements, owner reports and rental applications cannot be guessed. Statement and other document links stop working after 30 days. Owner report and application links work until the Customer turns them off.
12. Protection Against Misuse
12.1 The Service refuses automated access, and limits the number of requests each person and each company can make, so that no one can overload it or slow it for other companies.
13. Security Incidents
13.1 If we find that a company's Customer Data has been accessed or disclosed without authorisation, we email its Administrator within 24 to 48 hours of finding it, with what happened and what we are doing about it, and we take steps to contain it.
14. Reporting a Security Problem
14.1 If you find a security problem in RentSaab, email admin@rentsaab.com with what you found and how to reproduce it. We reply within 12 hours.
14.2 Do not access, change or delete data that is not yours, do not disrupt the Service, and do not test it further without our written permission, as our Acceptable Use Policy requires.
15. The Customer's Part
15.1 Security is shared. The Customer is responsible for keeping its Authorised Users' passwords and devices secure, turning on two-step verification, giving each person only the access they need, removing access promptly when it is no longer needed, and telling us at once if it suspects unauthorised access.
Contact Us
Questions about this page go to admin@rentsaab.com. If you are a tenant, owner or vendor of a company that uses RentSaab, ask that company first, because it decides what it records about you.