Security

An overview of how CueProperty protects agent and visitor data. If you need more detail for a vendor security review, contact mick_orr@hotmail.com.

Encryption in transit and at rest

All traffic to and from CueProperty is encrypted over HTTPS/TLS. Data at rest — agent accounts, listings, feedback, and offers — is stored in a managed Postgres database with encryption at rest, provided by our infrastructure partner Supabase.

Per-agent data isolation

Every table is protected by database-level Row Level Security (RLS) policies, not just application logic. An agent's listings, feedback, and offers are only ever readable by that agent — enforced at the database itself, so a bug in the application code can't leak one agent's data to another.

Authentication

Passwords are hashed and never stored in plain text, using Supabase Auth's industry-standard authentication. Session tokens are short-lived and refreshed automatically.

Payment data

Subscription payments are handled entirely by Stripe, a PCI DSS Level 1 certified payment processor. Card details are entered directly into Stripe's hosted checkout — they never pass through or get stored on CueProperty's servers.

Abuse and spam protection

Public visitor forms (feedback and offers) are protected by Cloudflare Turnstile, a privacy-friendly CAPTCHA, plus server-side rate limiting to prevent automated abuse.

Data deletion

Agents can permanently delete their account and all associated data at any time from Settings. Visitor feedback or offers can be deleted individually by the listing agent on request. See our Privacy Policy for details.

Responsible disclosure

If you believe you've found a security vulnerability, please report it to mick_orr@hotmail.com before disclosing it publicly. We'll acknowledge reports within 2 business days.