Security
How we protect your data
HomesMatrix handles some of the most sensitive information your organization holds — household income, eligibility, and financial details. Isolation and accountability aren’t features bolted on later; they’re built into how the platform works. Here is what that means in practice.
Tenant isolation
Each organization’s data is walled off
The single biggest risk in a multi-organization platform is one organization seeing another’s data. We address it at the database layer, not just in application code.
- Per-organization workspacesEach organization’s data is isolated at the database layer with PostgreSQL row-level security — queries are scoped to the acting organization.
- Fail-closed at startupOn boot, the platform verifies that row-level security is actually enforced on its database connection, and refuses to serve traffic if that can’t be proven.
- Proven, not assumedAn automated test confirms that one organization cannot read another’s data — isolation is part of the test suite, not just the design.
Access & accountability
Who did what, and who’s allowed to
Sensitive decisions are governed by role and recorded permanently — so access is controlled and every determination is defensible after the fact.
- Role-based accessGranular authorities determine what each user can see and do; least-privilege is the default.
- Separation of dutiesEnforced where it matters: the person who assesses a case can’t validate it, and the person who prepares a resale calculation can’t approve it — any exception is recorded as a reasoned, visible waiver.
- Two-factor authenticationTime-based one-time-password 2FA is available to users, and an organization’s admin can require it for the whole organization; enrolled secrets are encrypted.
- Committee approvalsHigh-stakes decisions — homeowner selection, job selection, family services — route to the committee that holds that authority, and are recorded rather than handled informally.
- Accountable decisionsDeterminations, approvals, and amendments are stamped with who acted, when, and the ruleset version — recorded as new, attributed entries the application never edits or erases.
- Sign-in protectionFailed-login lockout and least-privilege database roles limit exposure from compromised credentials.
Encryption & infrastructure
Protected in transit, at rest, and in the browser
- Encryption in transitTLS everywhere, with HTTP Strict Transport Security enforced.
- Document storageUploaded documents are kept in a private object store, encrypted at rest by the provider, and delivered only through short-lived signed links — never public URLs.
- Data at restThe database runs on managed cloud infrastructure with encryption at rest, and sensitive secrets such as 2FA keys are additionally encrypted by the application.
- Hardened responsesA strict Content-Security-Policy plus standard security headers (frame denial, no-sniff, referrer policy).
- Managed infrastructureRuns on managed cloud platforms with their own physical, network, and operational security.
Where we are
Current status — stated plainly
The controls above are built into the platform today. HomesMatrix is pre‑general‑availability, and we’re deliberate about what we claim: we do not yet claim formal certifications such as SOC 2, and our formal compliance posture for sensitive financial data is being developed with counsel. We’d rather tell you exactly what is true now than imply more.
For a deeper security review, or questions from your IT or compliance team, contact security@homesmatrix.com.
See how it works on your programs
A short, tailored walkthrough — with your security questions welcome.