Boring, on purpose.

Every row in every table carries a village_id. Postgres Row-Level Security policies enforce that no query can ever see another village's data, even with admin credentials. CI runs negative tests on every deploy.

A one-time pass cannot be used twice. Even if two guards scan it at the same millisecond, exactly one gets ALLOWED and the other gets PASS_ALREADY_USED. This is enforced at the database level with a single SQL UPDATE … RETURNING, not in application code — so the guarantee survives serverless cold starts, retries, and crashes.

Every write endpoint accepts an Idempotency-Key. Retry the same request a hundred times — you get the same result, recorded once. No double-charges. No duplicate entries. No accidental double-grants when the visitor refreshes the page mid-submit.

HOA elections need real ballot secrecy. We generate a fresh RSA-OAEP keypair for each election. Ballots are encrypted with the public key at cast time. The private key is sealed with AES-256-GCM and is only decrypted inside the explicit admin-triggered "close election" flow. Mid-election, nobody — including platform admins with database access — can read individual votes.

Every security-relevant action writes to an audit table the application role cannot UPDATE or DELETE. Pass creation, validation, override, payment, vote — they're all there. The board can ask "who did what, when" and get an honest answer.

Visitor photos are retained 90 days. Government-ID photos (used in lax-mode entries and overrides) are retained 30 days in a separate, stricter bucket. Visitors can request deletion of their own photos through a public form, fulfilled within 30 days as required by the Philippine Data Privacy Act.

Residents and guards sign in with SMS OTP — no passwords, no password resets. Short-lived session tokens with refresh rotation. Guard devices have a fingerprint that lets HOA admins remotely revoke access if a phone is lost.

• We never sell or share resident data with third parties.
• We don't embed third-party tracking on the resident or guard apps.
• We don't hold HOA funds — payments settle directly to your HOA's bank account.
• We don't require a contract longer than 12 months. Cancel any time before renewal.

Threshold-encrypted ballots (where multiple board members must cooperate to decrypt) is on the roadmap for Enterprise. Self-hosted deployments for villages with strict data residency needs are available as a custom engagement. Talk to us if these matter to your board.