Security at Rehabfolio
Rehabfolio is an early-access product built on Cloudflare infrastructure. This page describes what the system does today, plainly - no compliance theater, no badges we have not earned.
Workspace isolation
Every record - projects, budgets, expenses, files, invites - is scoped to a workspace and checked server-side on every request. Mutations re-verify that the row being changed belongs to your workspace before writing; cross-workspace access is refused. Team members carry role-based access: owner, admin, member, or viewer.
Where your data lives
Workspace data is stored in a Cloudflare D1 database. Uploaded files - walkthrough photos, receipts, documents - live in Cloudflare R2 object storage. Infrastructure runs on Cloudflare's network; we do not operate separate data centers.
API keys & signed webhooks
Outbound webhooks and automation deliveries are signed so receivers can verify payloads before acting on them. When a machine-access API key is issued for an approved integration, it is shown once at creation and stored only as a one-way hash with a short prefix - we cannot recover a lost key, only revoke it.
Public links you can revoke
Project update share links and the calendar feed are token-gated public URLs. Each can be rotated or revoked individually, and Settings → Security & data inside the app includes a "Revoke all public links" control that kills every active share at once. The same screen summarizes your exposure: active API keys, webhooks, and public links.
Analytics without trackers
Workspace analytics are first-party only: anonymous page-view and click events recorded in our own database. Our public marketing pages use Google Analytics (GA4) to measure page performance. There are no ad networks or cross-site ad trackers on Rehabfolio.
AI data handling
Content you submit to AI features - listing text, walkthrough photos, receipts - is sent to third-party AI providers only when you invoke the feature, never in the background. AI outputs are drafts until you accept them. The full breakdown of providers and data sent is on the AI disclosure page.
What we do not claim
Rehabfolio has not undergone SOC 2, GDPR, or similar third-party compliance certification. What exists today is described above and in the privacy policy; material changes will be posted on those pages with new dates.
Try it with your own deals
Try the instant underwrite without a card. Paid plans include a 14-day trial.
No card · You approve every AI draft