Trust

Security & Data Handling

condo.insure holds unit-owner names, contact details, and insurance declaration pages for condominium associations. This page describes, in plain terms, where that data lives, who can see it, and how it is protected. It describes the system as it runs today — not a certification we hold.

Last updated 2026-09-24 · Questions: support@condo.insure

Where data lives

• Database and sign-in: Supabase — managed Postgres for records and Supabase Auth for accounts. We never store passwords ourselves; password resets use a one-time token.
• Application: hosted on Railway, served over HTTPS only.
• Email: reminders and invites are sent through Resend from a dedicated sending domain.
• Payments: handled by Stripe checkout and billing portal. Card numbers go to Stripe directly; we never see or store them.

Documents

Declaration pages and shared association documents are kept in private storage buckets — there is no public URL for any owner or association document. When an authorized user opens one, our backend checks their access and issues a short-lived signed link (valid for a few hours) for that single file. Uploads are insert-only: an upload never silently overwrites an existing document.

Who can see what

• Association administrators see their own association's units, owners, and policy records.
• Property management firms see the associations they manage. Within a firm, owners and managers see the whole portfolio; members can be limited to the associations assigned to them.
• Unit owners see only their own unit and policies, plus documents their association shares with all owners.
• Our support team can access accounts to set them up and help when asked.

These rules are enforced on the server for every request, from the role stored in the signed-in user's verified session — not by hiding buttons in the browser. Invitation links can never set or reset the password on an existing account, so a forwarded invite can't be used to take one over.

AI document reading

To read declaration pages, we send the document's text (or, for scanned documents, the page images) to Anthropic's Claude models through Anthropic's commercial API. Per Anthropic's commercial terms, API inputs and outputs are not used to train their models by default. The extracted fields (insurer, policy number, dates, coverage limits) are stored with the unit's record so administrators can review them.

Backups

Every night, the document buckets (declaration pages, leases, and shared association documents) are copied to a separate storage provider, Backblaze B2. The job is deliberately append-only: it adds new files and never deletes, so a document removed by mistake in the app still exists in the backup.

Your data, your export

Administrators can download their association's compliance data as a CSV at any time — units, owners, contact details, and policy status — and every stored document can be downloaded from the dashboard. To have personal information deleted, email support@condo.insure; see the privacy policy for details.

The insurance agency relationship

condo.insure is built by the team behind universalcondo.com, a licensed Florida insurance agency. Reminder emails to owners include an optional link to request a quote from that agency. Owners are never required to use it, compliance status never depends on where a policy is bought, and we never sell owner or association data.