Privacy and security
Residents’ information, handled with care.
Rooted is built so each person sees only what they should, and resident data is never for sale.
We never sell resident data.
Not to advertisers, not to data companies, and not even de-identified.
How it’s built
Each person sees only what they should
Access follows each person’s role
A resident sees their own requests and what neighbors choose to share. Staff see what their job needs, for the buildings or communities they work in.
Rules kept in the database itself
Who can see what is enforced by the database, not just by the screens, and automated tests check those rules before any change goes out.
A second step to sign in
Staff sign-in is built to ask for a second step, so a stolen password alone isn’t enough.
A record of who looked
Rooted is built to record each time someone views, changes or exports personal information: who did it and when.
Private by design
What stays private
- Notifications are written to leave out private details. They say there’s an update, not what it is.
- Our rules keep personal details out of logs, error reports, analytics and web addresses.
- Residents choose what neighbors can see on their profile.
Standards
Getting ready for a SOC 2 audit
SOC 2 is an independent audit of a company’s security habits. We’re building those habits into how we work from the start.
Every change checked
Each change goes through automated tests and checks before it ships, and every commit is scanned for leaked passwords and keys.
Least access
Our own team gets only the access its work needs, with a second step to sign in.
Built for every reader
Rooted is built to meet the WCAG 2.2 AA accessibility standard, and screens are checked at the largest text size.
Questions about security?
Your IT and compliance teams are welcome to ask us anything. Put your questions in the demo form, and we’ll answer them.