Security & data
Security and Your Company’s Data
Your rentals, vendor invoices and project history are business records. Here is how Rental Leak keeps them separate, private and accounted for — in plain language, with nothing overstated.
Separation
Your company’s data stays your company’s
- Kept apart in the database itself. Every record belongs to one company, and the database only returns records from the signed-in person’s own company. It is enforced on the server, not just by what the app chooses to show.
- Private files. Agreements, invoices, tickets and photos are stored in your company’s private folder and opened only through short-lived links issued to signed-in members of your company.
- Encrypted in transit. Every connection between your device and Rental Leak uses HTTPS.
- Card details never reach Rental Leak. Subscription payments are handled by Stripe. Rental Leak keeps only Stripe’s references and, for display, the card brand and last four digits.
- QuickBooks credentials stay on the server. When an owner or office manager connects QuickBooks Online, the access tokens are stored encrypted and used only by Rental Leak’s servers — never sent to a browser or phone. Rental Leak never asks for your QuickBooks password, and disconnecting revokes its access.
Roles
Who can do what
Three roles. Each rule is enforced by the server, so hiding a button is never the only thing standing in the way.
Owner / Admin
Everything an office manager can do, plus changing anyone’s role, deactivating or reactivating team members, and deleting the company.
Office / Manager
Manages billing, connects and uses QuickBooks Online, corrects rates and other confirmed rental details, reviews vendor invoices, imports spreadsheets, voids a rental entered by mistake, sets project budgets and adds field users or managers.
Field User
Adds and scans rentals, keeps them, requests off-rent and records returns, and works in tasks, the Daily Log and punch lists. Cannot change a confirmed rate, delete a rental or change vendor invoices.
Field crews get what they need on the jobsite, and the numbers the office relies on stay with the office. See how the roles work together on tracking rentals across jobsites.
Accountability
Nothing changes quietly
- History only grows. Every rental keeps a history of who did what and when — added, kept, off-rent requested, returned, edited, and how the vendor was told. Entries are added, never rewritten.
- Money fields are protected. The rate, billing period, start date, vendor and project can only be changed through a recorded edit that keeps the old and the new value.
- Voided, not deleted. A rental entered by mistake is voided: it leaves the totals, its record and history stay, and it can be restored.
- Leaving the team ends access, not the record. A deactivated member loses access to your company, and everything they recorded stays under their name.
- Administrative actions are logged. Rental Leak staff actions on a customer account are written to an audit log that cannot be edited or deleted.
The same history backs up an invoice dispute: see rental invoice reconciliation and charged for rental equipment after a return.
Document reading
How AI is used, and how it isn’t
- Only to read a document you chose. When you scan or upload an agreement, invoice or ticket, the file is sent from Rental Leak’s server to the document-reading provider (currently Anthropic) to read its fields.
- Never used for training. Your documents and records are not used to train the provider’s models or any Rental Leak model.
- A suggestion, never a decision. What it reads is shown for a person to confirm. Nothing is saved until someone presses the button, and a value it could not read stays blank.
- Not kept around. The reading result is cached for about 24 hours so the same file is not read twice, and document contents are never written to Rental Leak’s logs.
Your data, your call
Where it lives, and how you leave
Stored in the United States
The database, sign-in and file storage run on Supabase. Rental Leak does not sell your data. Every provider and what it does is listed in the privacy policy.
Take it with you
On Contractor and Pro, export rentals as PDF, CSV or Excel, and vendor invoices and cost detail as CSV or Excel. See integrations for every export.
Cancel or delete
Cancelling keeps your records, read-only. Deleting the company is a separate request with a 30-day grace period, described on delete your account.
Common questions
Can another company see our rentals or invoices?
No. Every record belongs to one company, and the database itself only returns the signed-in person’s own company’s records. Files are kept in that company’s private folder and opened through short-lived links.
Can a field user change a rental rate?
No. A field user can add rentals and move them through keep, off-rent and return, but the rate, billing period, start date and other confirmed details can only be changed by an owner or office manager, and every change is recorded with the old and new value.
Do you sell our data or use it to train AI?
No. Rental Leak does not sell your data, and your rental records and documents are not used to train AI models, ours or the document-reading provider’s.
Where is our data stored?
With Rental Leak’s service providers in the United States: the database, sign-in and file storage run on Supabase. The privacy policy lists every provider and what each one does.
What happens to our data if we cancel?
Cancelling the subscription does not delete anything. The company becomes read-only: you can still sign in and see your history. Deleting the company is a separate request with a 30-day grace period.
Will you answer our security questionnaire?
Yes. Email support@getrentalleak.com with your questionnaire or questions. Rental Leak does not hold a SOC 2 report or a similar certification today, and we will say so plainly rather than overstate it.
Keep reading
Related
Questions from your IT or finance team?
Send them to support@getrentalleak.com, or walk through the app on a demo call. The 30-day free trial needs no credit card.