Built secure from the ground up.
iPO Hub's security model is not a feature layer — it is the foundation. Every architectural decision, from zero rent custody to the SHA-256 audit ledger, is designed to eliminate attack surface and ensure evidentiary integrity.
Security by architecture
Security properties that cannot be disabled because they are structural invariants, not configuration options.
Zero Rent Custody
iPO Hub never holds, routes, or has custody of rental income. Rent flows directly from tenant to landlord via standing order. This is an architectural guarantee — not a policy — eliminating an entire class of financial fraud risk.
- Zero custody of rental income
- No payment intermediary role
- Standing order: tenant → landlord
- Eliminates misappropriation risk
SHA-256 Hash-Chained Ledger
Every compliance event is recorded in an append-only, SHA-256 hash-chained audit ledger. Each entry references the hash of the previous entry, making retroactive tampering mathematically detectable. CPR Part 39 compliant.
- Append-only event store
- SHA-256 hash chaining
- Tamper-evident by design
- CPR Part 39 evidence bundles
Zero-Password Authentication
iPO Hub uses passkeys (WebAuthn FIDO2) and magic-link email authentication. No passwords are ever stored, transmitted, or at risk of breach. Phishing-resistant by design.
- WebAuthn FIDO2 passkeys
- Magic-link email auth
- No password database
- Phishing-resistant
Infrastructure security
iPO Hub runs entirely on Cloudflare's global edge network — one of the world's largest and most secure infrastructure platforms. Every request is protected by enterprise-grade DDoS mitigation, WAF, and TLS 1.3.
Cloudflare Edge Runtime
All compute runs at the edge — no origin server to attack. Workers execute in V8 isolates with strict memory and CPU sandboxing.
TLS 1.3 Everywhere
All data in transit is encrypted with TLS 1.3. Older protocol versions are rejected. HSTS enforced with preloading.
AES-256 at Rest
All stored data — documents, compliance records, audit ledger — is encrypted at rest using AES-256.
DDoS & WAF Protection
Cloudflare's global anycast network absorbs volumetric attacks. WAF rules block OWASP Top 10 and custom threat signatures.
Zero Trust Network Access
Internal tooling and admin access is gated by Cloudflare Access with hardware key MFA. No VPN required or used.
Data security controls
Access to data is governed by role-based controls, principle of least privilege, and comprehensive audit logging. Every data access event is recorded.
Role-Based Access Control
Landlords, property managers, and tenants each have scoped access. No user can access data outside their authorised portfolio.
Principle of Least Privilege
Every service, agent, and API key is granted only the minimum permissions required for its function.
Immutable Audit Trail
All data access, modifications, and compliance events are recorded in the SHA-256 hash-chained ledger. Cannot be deleted or altered.
Document Isolation
Compliance documents (CP12, EICR, EPC, tenancy agreements) are stored in isolated R2 buckets with signed URL access. No public URLs.
GDPR Data Minimisation
We collect only the data necessary for platform operation. Tenant PII is scoped to the landlord's portfolio and never shared across accounts.
Certifications & compliance posture
UK GDPR
✅ Compliant
DPA 2018
✅ Compliant
SOC 2 Type II
🔄 In Progress
ISO 27001
🔄 Roadmap
PCI DSS
✅ Via Processor
Cyber Essentials
✅ Compliant
Responsible disclosure
We take security vulnerabilities seriously. If you discover a security issue, please report it responsibly to [email protected]. We commit to acknowledging reports within 24 hours and providing a resolution timeline within 72 hours.
We do not pursue legal action against researchers who act in good faith and follow responsible disclosure principles.