Data in transit and at rest
All traffic to RentPlace is served over HTTPS with modern TLS, and HTTP requests are redirected rather than served. That part is live today and you can verify it from your own browser.
Listings, inquiries and account records sit in our production database with our hosting provider. We do not claim disk-level encryption at rest or a third-party security attestation, and we would rather say that plainly than describe controls we cannot show you.
RentPlace has no passwords to steal. You sign in to your panel through a private link of 48 random characters that we email to the address on your account. We store only a hash of that link, it stops working after 30 days without a visit, and requesting a new one replaces the old one.
RentPlace never touches money between you and your renters. It does not collect rent, it does not hold deposits, and it never asks you or a renter for a bank login or bank account details. The only payment on RentPlace is your own subscription, paid by card on the secure checkout page of our payment processor, so card details never reach our servers.
Access control
On the Landlord plan, your account is one seat: whoever holds the current panel link can add, edit and pause listings, set screening questions and export inquiries. Treat the link like a key, and request a fresh one from the panel link page if you think it has been shared. Renter inquiries reach you by email from RentPlace, with your own address kept off the public listing page.
Seats for a team, portfolio-scoped roles and SSO belong to the higher plans described on the property managers page.
On our side, the policy we hold ourselves to is that production access is limited to the people who operate the system, is authenticated with a second factor, and is logged. Today that is a very short list of people rather than an audited access programme, and we are not claiming a hardware-token rollout or a log review process we have not built. We do not read your inquiry contents as a matter of course, and support access to an account is granted only on request and time limited.
What we deliberately do not do with renter data
Renters use RentPlace free and pay nothing at any point. We therefore do not sell, rent or broker renter data, we do not charge application fees, and we do not pass renter contact details to third parties who want to market to movers. The screening answers a renter provides go to the landlord or manager of the listing they contacted and to nobody else.
RentPlace does not perform consumer reports, credit checks or criminal background checks, and it is not a consumer reporting agency. It records the answers an applicant gives to the questions a landlord asked. Screening decisions and screening criteria remain the landlord's, and must be applied identically to every applicant. See how a tenant background check actually works for what that means in practice.
Sub-processors
We use a small number of infrastructure providers for hosting, transactional email, error monitoring and the language model that powers the Listing Grader. The current list, with what each one processes, is available on request to support@rentplace.com and is provided as an appendix to the data processing agreement on the Enterprise plan.
Text you paste into the public Listing Grader is sent to the model provider to produce the grade and is not stored by RentPlace afterwards.
Retention, export and deletion
Your listings and inquiries are yours. Every plan can export them in CSV at any time, without asking us. When you close an account we delete listing and inquiry data within 30 days, except where we are required to retain a record for tax or legal reasons, and backups age out on their own schedule within 90 days.
You can request deletion of a specific record at any time by emailing support@rentplace.com from the address on the account.
Reporting a vulnerability
Full detail on what we collect and why is in the privacy policy, and the contractual side is in the terms of service.
Email support@rentplace.com with the words "security report" in the subject. Tell us what you found and how to reproduce it. We will acknowledge within three business days. Please do not run automated scans that degrade the service for other people, and please do not access, modify or exfiltrate data belonging to anyone else while testing.