Security at Stewardly

Your community's financial records and homeowner data are sensitive. Here is exactly how we protect them.

Our honest position on certifications

Stewardly is an early-stage company, and we don't claim certifications we don't have — we have not yet completed a formal SOC 2 audit. What we do have is a genuine security-first architecture built to align with the controls those frameworks look for: encryption everywhere, least-privilege access, per-tenant isolation, continuous backups, and monitoring. If a formal SOC 2 report is a requirement for your organization, please reach out — we can prioritize it, and the technical foundation is already in place.

What we do to protect your data

Encryption in transit

All traffic between your browser and Stewardly is encrypted with TLS 1.2 or higher. We enforce HTTPS everywhere and set HSTS — unencrypted connections are rejected.

Encryption at rest

Data stored in Stewardly is encrypted at rest with AES-256, using dedicated AWS KMS keys with automatic key rotation. Financial records get their own encryption key, separate from other data.

Modern, phishing-resistant sign-in

Authentication runs on AWS Cognito. Beyond passwords, we support passkeys (Face ID / Touch ID / security keys), two-factor authentication, and passwordless one-time email codes. Passwords are never stored in plain text.

Role-based access control

Every user has a role — board admin, board member, or homeowner — that controls exactly what they can see and do. Homeowners cannot access other residents' data or board-only records.

Per-HOA data isolation

Every HOA is a separate tenant. Your community's data is isolated on every request — no board member or homeowner can ever reach data belonging to a different HOA, enforced at the API authorization layer.

Payments & bank connections

Card payments are processed by Stripe (PCI-DSS Level 1) — Stewardly never sees or stores card numbers. Bank connections use Plaid: your banking credentials are entered directly with Plaid and are never seen or stored by Stewardly.

Private network isolation

Our databases run in private, isolated subnets with no public internet access — reachable only by our application inside a locked-down virtual private cloud. Application secrets live in AWS Secrets Manager, never in code.

Backups & recovery

Automated encrypted backups run continuously with a 14-day point-in-time recovery window, and deletion protection guards the database against accidental removal. We can restore to any point within the retention window.

Monitoring & alerting

Application and database health are monitored with AWS CloudWatch. Error-rate, latency, and connection alarms notify our team automatically so issues are caught early.

Audit logging

API activity is captured in structured logs retained for 30 days for troubleshooting and security investigation — including timestamps, the endpoint, and the response status.

Managed cloud infrastructure

Stewardly runs entirely on Amazon Web Services (US region) using managed, highly available services — AWS Lambda, RDS PostgreSQL, S3, API Gateway, and Cognito — so there are no servers for us to leave unpatched.

Least-privilege access

Every part of the system is granted only the permissions it needs. Each service can reach only the specific secrets and resources required to do its job — nothing more.

What we don't do with your data

We do not sell your data or homeowner information to third parties — ever

We do not use your HOA's data to train AI models or analytics products

We do not share individual homeowner PII with other Stewardly customers

We do not send emails to your homeowners without your explicit action

Responsible disclosure

If you believe you have discovered a security vulnerability in Stewardly, we want to hear from you. Please report it to us directly before disclosing it publicly. We commit to:

Acknowledging your report within 2 business days
Investigating the issue and keeping you updated on our progress
Fixing confirmed vulnerabilities in a timely manner
Crediting you (if you wish) when the issue is resolved

Report a vulnerability

security@stewardly.biz

Please do not report security issues via public GitHub issues or social media.

Security questions?

We're happy to answer specific security questions from board members and IT administrators.