Your personal details, your password, and your money are protected by the same kind of layered defences used by global property and payment platforms. Here's what we have in place — in plain English.
We treat your data the way we'd want ours treated. Below are the eight layers of protection between an attacker and your account. Each one runs around the clock, with no action needed on your side.
Every page, every form, every payment runs over 256-bit TLS — the same encryption your bank uses. Browsers refuse to load Propworths over an unencrypted connection, ever.
We never store passwords in readable form — they're hashed with bcrypt, the same standard used by Apple, Stripe and Google. Even if someone got hold of our database, your password would still be safe.
Every time someone signs in to your Propworths account from a new device or network, you get an immediate email — when, where, and what to do if it wasn't you. If a password reset is requested, you're told who, when, and how to lock the account down.
Card details never touch our servers. Every transaction goes through Peach Payments — a regulated, PCI-DSS-compliant processor — and gets a tamper-proof signature we verify before recording anything as paid.
Contact forms, sign-up forms, OTP requests, voice search, AI chat — every public endpoint is rate-limited per IP, with honeypots to catch automated abuse before it reaches our pipeline.
The admin dashboard sits behind three independent gates — a hosting-level password challenge, a server-side role check, and an optional IP allow-list. Even a successful breach of one layer doesn't expose your data.
You can download every piece of information we hold about you, in machine-readable form, at any time. Or delete your account entirely — and we'll scrub your personal details from our audit logs while keeping only what tax law requires us to keep.
Every login attempt, every form submission, every payment event flows into a structured audit log with a calibrated threat-level rollup. Anything unusual — a burst of failed logins, a webhook from an unrecognised IP, an admin refusal — surfaces immediately for review.
You can exercise your data rights yourself, online, without waiting for us. We typically respond to any direct enquiry within one business day.
Don't take our word for it. Run our domain through securityheaders.com or Mozilla Observatory — both score our configuration A or higher. Our payment provider is regulated by the Financial Sector Conduct Authority of South Africa.