Security at Bello Homes

Platform security

Access and data boundaries are enforced throughout the management platform.

• Strong sign-in. TOTP two-factor authentication is enforced for administrative and staff access.
• Least privilege. Role-based access control uses least-privilege module loading, so staff see only what their role requires.
• Accountable administration. Every administrative money-affecting action is recorded in append-only audit trails.
• Data boundaries. All internal data is protected by database-level row security.
• Release integrity. Application assets are immutable and integrity-checked using Subresource Integrity (SRI).

Application security practice

Security review is part of how the platform is maintained.

• Recurring review. Internal security audits are aligned to the OWASP Top 10, with focused review of authorization, injection and XSS, and authentication.
• Verified webhooks. All inbound webhooks that process events are cryptographically verified using HMAC before processing and are fail-closed.
• Secret handling. Secrets are never stored in source control.
• TLS everywhere. TLS protects all Bello Homes production web traffic.

Data protection

Guest and owner information is handled according to its purpose and sensitivity.

• Controlled access. Guest and owner personal data is stored with row-level access controls.
• Private documents. Financial documents remain in private storage and are accessed only through short-lived signed URLs.
• Data minimization. We limit personal-data collection and use to what operations require.

We retain personal data only as long as operationally necessary and delete it when it no longer is.

Operational reliability

Operational readiness supports a prompt, disciplined response when an issue occurs.

• Coverage and escalation. Bello Homes maintains 24/7 operations coverage with documented escalation paths.
• Proactive dependency patching. Dependencies are patched proactively, and security patches are prioritized.
• Incident response. We commit to acknowledge and contain security incidents, and to notify affected parties as required by law.