Your rental records should stay yours.

Access

Who can see your data?

Your owner workspace is scoped to your account. Property, ledger, document, and maintenance lookups resolve through the current owner, so knowing a property ID is not enough to open another owner's records.

Tenants use a separate portal session tied to one tenant and one property. They can see only the resident surface: documents you explicitly share and confirm, their lease terms, rent and payment details, maintenance records and photos, resident messages and notices, property information intended for residents, and their own profile. They cannot see your owner workspace, your full ledger, or documents you have not shared with them.

Authentication

A real session for each user

First-party sessions support Google OAuth and email sign-in codes. Password sign-in is also implemented for configured first-party deployments. After sign-in, the app uses an rpb_session cookie that is HTTP-only, SameSite Lax, and limited to a 30-day session window. This page makes no MFA claim because multi-factor authentication is not part of this flow.

Storage

Where your data lives

Postgres is the system of record for structured property, tenant, lease, ledger, maintenance, document, and audit data. When you connect Google Drive, it is the file system of record for the property files and financial sheets that RentMochi syncs there. Drive credentials are looked up for the owner who connected them.

There is one deliberate exception. A tenant-captured maintenance photo is written to Postgres first, then promoted to the owner's Drive by /api/drive/sync. A tenant cannot write to Drive at capture time because Drive access is owner-scoped. Staging the photo first means the evidence you need is not lost while waiting for the owner's Drive connection.

Google permissions

Two Google connections, two jobs

Google sign-in requests the openid, email, and profile scopes so the app can verify your identity and basic profile. That sign-in permission is separate from Drive access.

The Drive connection requests only https://www.googleapis.com/auth/drive.file. RentMochi uses that file scope to organize the property folders, documents, and financial sheets it works with. The integration does not request broad full-Drive access.

Confirmation first

Nothing books money silently

AI can prepare a proposal, but the ledger finalization path rejects a request unless you explicitly confirm it. A confirmed database entry is marked as user-confirmed, keeps its source document, and writes an audit event. The shared audit record carries the actor, timestamp, and object, while the core ledger confirmation event also records the outcome and review context.

That gives you a trail back to what changed and how the financial record was approved. It is a product rule, not a promise that an AI suggestion is correct without your review.

Portability

Export and deletion, honestly

An authenticated owner can download a JSON export of account data, including properties, tenants, ledger entries, maintenance, documents, audit logs, portal payments, provider events, fees, deposits, and export snapshots.

Account closure is not immediate erasure. The current closure path creates a final export snapshot and schedules a 30-day delay. Its purge boundary currently records eligibility but explicitly runs no destructive purge yet. If you want to request deletion or need help with closure, contact support below.