Clerk authentication
User identity is handled through verified authentication tokens and protected routes.
Security and trust
Professional property workflows need dependable protection
EstateAI applies layered authentication, ownership checks, secure storage access, verified billing events and auditable activity.
Security foundations
Protection across identity, data, billing and operations
The platform is designed around least privilege and verified server-side decisions.
Server-side authorisation
Backend services validate ownership and organisation permissions instead of trusting frontend identifiers.
Secure object storage
Property media is stored in Cloudflare R2 with controlled access patterns and signed delivery where required.
Stripe payment handling
Checkout, recurring billing and customer portal activity use Stripe rather than storing raw card details in EstateAI.
Verified webhooks
Billing events are signature-verified, idempotently processed and logged.
Activity and lifecycle records
Important property, organisation, notification and billing actions are persisted for operational traceability.
Retention controls
Archived, deleted and excess-storage data follow defined retention and cleanup workflows.
No unsupported compliance claims
EstateAI describes implemented controls without presenting unverified certifications.
Production hardening
Configuration validation, structured logging, rate controls and readiness checks support reliable deployment.