Skip to content

Security & trust

Your data, secure and GDPR-compliant.

CasaHero manages sensitive tenant and management data. That is why security, privacy and verifiability are built in from the ground up — not bolted on afterwards.

  • GDPR-compliant
  • Hosted in Germany
  • Encrypted in transit

Six pillars that together provide a robust level of protection.

How we protect your data

Hosting in Germany

Your data is stored on servers in Germany.

  • Application, database and file storage on Hetzner servers in Germany
  • Own mail server; only optional push notifications are delivered via Google and Apple
  • No tracking, no analytics tools, no advertising

Encryption

Encrypted in transit, passwords never in plain text.

  • TLS for every connection to the website, web app and mobile app
  • Passwords stored only as an Argon2id hash
  • Two-factor sign-in keys additionally encrypted with AES-256

GDPR-compliant

Data protection under European law, contractually secured.

  • Data processing agreement (DPA) per tenant
  • Data-subject rights: access, erasure, portability (Art. 20)
  • Retention periods enforced automatically, e.g. sign-in logs after 90 days

Strict tenant isolation

Every manager sees only their own data.

  • Row-Level Security (RLS) in PostgreSQL at the database level
  • Every request runs in the context of exactly one tenant
  • Super-admin access to tenant data is logged

Secure sign-in

Modern authentication with a second factor.

  • Token-based authentication (JWT)
  • Two-factor authentication via TOTP
  • 2FA available and recommended for property-management accounts, every code valid only once

Availability

A clear availability target and announced maintenance.

  • Operated in an ISO 27001 certified Hetzner data centre (the hosting provider’s certificate)
  • Internal target of 99.5% availability on an annual average; an SLA only if separately agreed
  • Maintenance windows announced at least 24 hours in advance

Traceable audit log & Your data belongs to you

Traceable audit log

Who reported what and when, who handled what and when: relevant actions are logged. That creates evidence in disputes and transparency for both sides.

Your data belongs to you

For every tenant you can export the stored data as a structured file (access and data portability under the GDPR) or erase it. When the contract ends, your data stays available read-only for 90 days; we provide a complete export (CSV and JSON, photos and documents in their original format) on request to kontakt@casahero.de within 14 days free of charge — also for switching providers under the EU Data Act. Known limitation: the export is delivered as a file package, not through an interface. Application, database, file storage and mail server are located in Germany and subject to German and EU law; requests from authorities outside the EU are only answered on a basis valid under EU law, we review each request individually and inform you where legally permitted.

Transparency

Our path to TÜV certification

TÜV certification is a declared goal of CasaHero — we build the platform with the underlying requirements in mind from the start. We will only communicate a certificate once it is actually granted, and we do not advertise something we have not yet achieved.

Get started

Ready for a relaxed tenant–management relationship?

Try it free for 30 days. No credit card required.