Security Security.

Encryption is applied at every layer, using current, industry-standard algorithms. We do not rely on obscurity or on any home-grown cryptography.

• At rest — AES-256-GCM. Personal data is encrypted at field level before it reaches the database, using 256-bit AES in Galois/Counter Mode. GCM is authenticated encryption: it detects tampering as well as preventing reading, so altered data is rejected rather than silently trusted. Names, contact details, dates of birth, addresses, income, bank and identity data are all stored encrypted, never as readable text. Each value carries its own random initialisation vector.
• In transit — TLS. All traffic is served over TLS with modern cipher suites. The platform is not reachable over unencrypted HTTP.
• Documents. Uploaded files are held in private storage that is never publicly addressable, and are released only through signed links that expire in minutes.
• Tokens and secrets. Signing and access tokens are 256 bits of cryptographically secure randomness and are stored only as SHA-256 hashes — the original value is never retained, so it cannot be recovered from our database even by us.
• Key management. Encryption keys are held in the platform secret store, separate from the data they protect, and are never committed to source control.

• Row-level security is enforced in the database, so an agency account can only reach its own data even if an application-layer check were missed.
• Two-factor authentication is available to all users and can be enforced across an agency.
• Least privilege — staff access is limited to what a role requires, and administrative functions are separately gated.
• Tenant-facing links use single-use, expiring tokens of 32 bytes of cryptographically secure randomness, stored only as a hash. A link cannot be guessed, and the raw token is never retained.

• Activity on references, offers, tenancies and contracts is audit-logged.
• Contract and signing events are held in an append-only log — the record cannot be edited or deleted, including by our own service accounts.
• Application errors are captured centrally and reviewed.
• Every subject-access search and export is logged against the staff member who ran it.

Our aim is to process personal data to the highest standard available to us, not merely to the minimum the law requires. In practice that means we build to recognised frameworks whether or not we are yet certified against them:

• UK GDPR and the Data Protection Act 2018 — data protection by design and by default, minimisation, purpose limitation and storage limitation applied as engineering decisions rather than policy statements.
• ISO/IEC 27001 principles — access control, encryption, logging, supplier assurance and incident management modelled on the Annex A control areas.
• SOC 2 Trust Services Criteria — security, availability, confidentiality and processing integrity, with the evidence trail those criteria require being generated as we operate, not assembled afterwards.
• NCSC guidance — the National Cyber Security Centre's Cyber Essentials control areas inform how we configure access, patching and boundary protection.
• Credit Reference Agency Information Notice (CRAIN) — the industry standard governing how credit reference data is used and explained to individuals.

Where a control is stronger than the law strictly demands — append-only audit logs, field-level encryption, automated deletion at the end of the retention period — we apply it because it is the right way to treat the data, not because we were required to.

PropertyGoose is registered with the Information Commissioner's Office (registration ZC014112) and maintains a completed Data Protection Impact Assessment for its referencing processing.

SOC 2 readiness is actively in progress, and the controls described on this page are built and running to that standard today. Formal SOC 2 and ISO 27001 certification is not yet in place — we state that plainly, because a security page that implies a certificate it does not hold is itself a reason not to trust it. The controls are real and independently verifiable on request.

If you believe you have found a security vulnerability, please tell us before disclosing it publicly. Email info@propertygoose.co.uk with enough detail to reproduce the issue.

We will acknowledge within 2 working days, keep you updated, and will not pursue action against anyone who reports a genuine issue in good faith, avoids accessing other people's data, and gives us reasonable time to fix it.