One fleet’s data cannot leak into another’s.
Most platforms filter tenants in application code and hope every query remembers to. Rentavoq filters below the application, where a bug can’t forget.
Every tenant-scoped query is filtered inside the database, below the ORM. An application bug can’t return another operator’s rows — the database refuses to.
Tenant context resolves per request from your subdomain or organization claim. Renter storefront sessions and operator sessions are kept fully separate.
An automated multi-tenant isolation test runs in CI on every change. Any cross-tenant read or write fails the build before it can ever ship.
Records that can’t be rewritten.
Deposits, claims, and key releases all rest on evidence. So the evidence is append-only — written once, never edited, never quietly deleted.
Every check — insurance, identity, contract, deposit, inspection — writes a timestamped record with provider, payload hash, result, and expiry. Key release is computed from those records. There is no manual override.
Every claim state change writes an immutable audit entry: photos, AI output, captures, and communications. Financial, inspection, and signature records follow the same append-only rule.
Every privileged action lands in an exportable, append-only log — who, what, when. MFA is forced on all admin logins, and support access is consent-noted and fully logged.
Encrypted everywhere. Collected sparingly.
The safest data is data we never hold. What we do hold is encrypted in transit, at rest, and — for the most sensitive fields — at the column level.
Payments run through Stripe’s hosted fields, so Rentavoq qualifies for the lightest PCI posture (SAQ A). Full card numbers never touch our servers — we keep tokens and the last 4 digits only.
TLS 1.2+ on every connection and AES-256 at rest. Sensitive columns — driver’s-license numbers, dates of birth — carry their own additional encryption layer.
Credentials and API keys live in a vault with rotation, and each operator’s integration credentials are encrypted with dedicated key management.
ID and selfie verification runs at the verification provider. Rentavoq stores a reference to the result — not the biometric data itself. We keep the pass, not your face.
Verification collects what a rental decision needs and nothing more. Biometric identifiers are retained by providers only as long as the verification purpose requires.
Every surface — operator app, storefronts, admin — targets WCAG 2.1 AA, and status is never conveyed by color alone.
Your renters’ data is processed, never sold.
For renter data, your business is the controller and Rentavoq is your service provider — we process it only on your documented instructions, and we never sell or share it.
The full list, with data categories per vendor, lives in the data processing addendum.
What we don’t claim.
Trust pages love borrowed badges. Here’s what we won’t put on this one — yet.
No SOC 2 badge today. SOC 2 readiness is on the roadmap. Until an auditor has signed, we publish our actual practices — the ones on this page — instead of a logo.
No uptime number yet. Availability targets and service credits are being finalized in the operator subscription agreement. We’d rather publish a real commitment than a marketing figure.
A platform, not an insurer. Rentavoq verifies coverage, holds deposits, and keeps the evidence. It does not insure vehicles, approve or deny renters, or decide claims — those decisions stay with you and your carriers.
Put our answers in writing.
Running a security review or a vendor questionnaire? Send it over. You’ll get plain-language answers, in writing, from the people who built the system.