Security & privacy

Your rental records should stay yours.

If you trust RentMochi with leases, tenant identities, rent records, receipts, maintenance history, Google Drive files, and private messages, you deserve a direct answer about what happens to them. This page explains what the product does today in plain English.

The short version

Your owner workspace is scoped to your account. Tenant access is scoped to a tenant and property. You approve financial changes, files can live in your connected Google Drive, and our AI data promises are shared directly with the Terms.

Access

Who can see your data?

Your owner workspace is scoped to your account. Property, ledger, document, and maintenance lookups resolve through the current owner, so knowing a property ID is not enough to open another owner's records.

Tenants use a separate portal session tied to one tenant and one property. They can see only the resident surface: documents you explicitly share and confirm, their lease terms, rent and payment details, maintenance records and photos, resident messages and notices, property information intended for residents, and their own profile. They cannot see your owner workspace, your full ledger, or documents you have not shared with them.

Authentication

A real session for each user

First-party sessions support Google OAuth and email sign-in codes. Password sign-in is also implemented for configured first-party deployments. After sign-in, the app uses an rpb_session cookie that is HTTP-only, SameSite Lax, and limited to a 30-day session window. This page makes no MFA claim because multi-factor authentication is not part of this flow.

Storage

Where your data lives

Postgres is the system of record for structured property, tenant, lease, ledger, maintenance, document, and audit data. When you connect Google Drive, it is the file system of record for the property files and financial sheets that RentMochi syncs there. Drive credentials are looked up for the owner who connected them.

There is one deliberate exception. A tenant-captured maintenance photo is written to Postgres first, then promoted to the owner's Drive by /api/drive/sync. A tenant cannot write to Drive at capture time because Drive access is owner-scoped. Staging the photo first means the evidence you need is not lost while waiting for the owner's Drive connection.

Google permissions

Two Google connections, two jobs

Google sign-in requests the openid, email, and profile scopes so the app can verify your identity and basic profile. That sign-in permission is separate from Drive access.

The Drive connection requests only https://www.googleapis.com/auth/drive.file. RentMochi uses that file scope to organize the property folders, documents, and financial sheets it works with. The integration does not request broad full-Drive access.

AI processing

AI processing, plainly

The promises below are the same shared commitments used in Terms section 7. They are rendered from the application's contract constants so the public explanation and the agreement cannot drift apart.

We do not train AI models on your content ourselves. Google and OpenAI are contractually barred from training on API inputs. DeepSeek's terms permit it to use submitted content to improve its models.

Your leases, receipts, messages, and financial records are processed for one purpose: to deliver RentMochi to you.

Owner-chat prompts and relevant property context go to Google Gemini by default, or to DeepSeek when selected in our deployment configuration. Resident-chat prompts and relevant tenant and property context go to OpenAI by default, or to Google Gemini or DeepSeek when selected. Utility text tasks, including memory compaction, listing drafts, negotiation assistance, natural-language query planning, and property summaries, go to OpenAI by default, or to Google Gemini or DeepSeek when selected. Google Gemini also processes onboarding chat, public demo chat, OCR, document extraction, and grounded vendor and price lookups. OpenAI may receive bounded document text for fallback metadata extraction. When configured, an automated second-opinion check sends an uploaded lease's extracted fields and OCR excerpt to DeepSeek. Content sent to DeepSeek is processed and stored on servers in the People's Republic of China. DeepSeek's terms permit it to use submitted content to improve its models. This applies to tenant content when tenant-facing features use DeepSeek.

Google Gemini receives owner-chat content by default, as well as onboarding chat, public demo chat, OCR, document extraction, and grounded vendor and price lookups. OpenAI receives resident-chat and utility-task prompts and relevant context by default, and can receive bounded document text for fallback metadata extraction. Resident-chat and utility-task content can go to Google Gemini or DeepSeek when selected in our deployment configuration. Google and OpenAI are contractually barred from training on API inputs.

DeepSeek, identified in the application as deepseek, can receive owner-chat prompts and relevant property context, resident-chat prompts and relevant tenant and property context, and utility text-task prompts and context when selected in our deployment configuration. The automated second-opinion lease cross-check can also send extracted lease fields and an OCR excerpt. Content sent to DeepSeek is processed and stored on servers in the People's Republic of China. DeepSeek's terms permit it to use submitted content to improve its models. This includes tenant content when tenant-facing features use DeepSeek.

These provider choices are controlled by RentMochi's deployment configuration. Lease cross-checking remains automatic when DeepSeek is configured and available; if it is unavailable, the fallback is manual review.

Confirmation first

Nothing books money silently

AI can prepare a proposal, but the ledger finalization path rejects a request unless you explicitly confirm it. A confirmed database entry is marked as user-confirmed, keeps its source document, and writes an audit event. The shared audit record carries the actor, timestamp, and object, while the core ledger confirmation event also records the outcome and review context.

That gives you a trail back to what changed and how the financial record was approved. It is a product rule, not a promise that an AI suggestion is correct without your review.

Portability

Export and deletion, honestly

An authenticated owner can download a JSON export of account data, including properties, tenants, ledger entries, maintenance, documents, audit logs, portal payments, provider events, fees, deposits, and export snapshots.

Account closure is not immediate erasure. The current closure path creates a final export snapshot and schedules a 30-day delay. Its purge boundary currently records eligibility but explicitly runs no destructive purge yet. If you want to request deletion or need help with closure, contact support below.

The blunt list

What we do not do

We do not sell your data. We do not use your content for advertising. We do not train AI models on your content ourselves. Google and OpenAI are contractually barred from training on API inputs. DeepSeek's terms permit it to use submitted content to improve its models.RentMochi exists to help you run your rentals, not to turn your records into someone else's dataset.

Read the full Terms or contact support at support@rentmochi.com.