Security at HomeCloak

A privacy service holds exactly the data its customers are trying to protect. Here is what we do with it, stated plainly.

• Your ownership document is encrypted at rest

  The utility bill or deed you upload is encrypted (AES-256) before it's stored, with a key that lives only on our servers. Even someone with access to the stored files couldn't read them without that key.

• Brokers never see your personal email

  Every request carries a relay address at our domain that belongs only to you. Replies come to us to be read and answered; your inbox stays empty. Your personal email leaves our systems only as a one-way hash (a scrambled code that can't be turned back into your address), which is what ad-tech brokers use to match records. No one can send email to it.

• Two-factor authentication

  Optional two-factor authentication works with authenticator apps like Google Authenticator, Authy, 1Password, and iPhone Passwords, on the website and the mobile app alike. Backup codes work once and are stored hashed.

• Passwords

  We store only a hash of your password, never the password itself. New passwords are checked against a public list of passwords exposed in past data breaches, in a way that never sends your password off our server. Ten failed attempts lock an account for fifteen minutes, and we email you whenever your password or two-factor settings change.

• Confirmed email, verified home

  Requests go out under a confirmed email address only, and only for a property whose ownership document passed verification. Nothing is sent for an address nobody has proven they live at.

• Verified incoming messages, protected background jobs

  Incoming emails and payment notices are accepted only when they carry a valid digital signature proving who sent them. Our scheduled background jobs can only be started with a secret key. Payments are handled by Stripe; we never see or store card numbers.

• Transport and browser protections

  Every connection is encrypted (HTTPS), and browsers are told never to connect to us unencrypted. Our pages only run scripts from our own site and a short list of approved analytics hosts. Other sites can't embed our pages inside theirs. Every form that sends email or creates an account is rate-limited to block abuse.

• What we don't do

  We don't sell or share your data with anyone. We don't log in to any site with your login details. We don't defeat CAPTCHAs or bot checks. When a site only accepts a request from you, we tell you exactly what to do and never pretend to be you.

See also the privacy policy.