Security at Acreonix

Overview

Acreonix handles sensitive property data — tenant records, lease agreements, financial transactions, WhatsApp conversations, and OAuth tokens connecting your Meta and TikTok accounts. We treat security as a product requirement, not an afterthought.

1. Infrastructure

Hosting

The Acreonix platform runs on Vercel (serverless functions, global CDN, UK edge) and Supabase (Postgres database, authentication, real-time, and file storage). Both are enterprise-grade, SOC 2 Type II certified infrastructure providers with dedicated security teams and published audit reports.

HTTP security headers Live

All responses from acreonix.co.uk and platform.acreonix.co.uk include the following security headers, configured in vercel.json:

• Strict-Transport-Security — max-age=63072000; includeSubDomains. Forces HTTPS for two years and protects all subdomains.
• X-Frame-Options: SAMEORIGIN — prevents clickjacking by blocking the platform being embedded in third-party frames.
• X-Content-Type-Options: nosniff — prevents browsers from MIME-sniffing responses away from declared content type.
• Referrer-Policy: strict-origin-when-cross-origin — limits referrer information sent to third-party origins.
• Permissions-Policy — disables camera, microphone, geolocation, and payment APIs for all embedded contexts.
• Content-Security-Policy — restricts script execution to trusted origins; blocks inline eval and data URIs for scripts.

2. Encryption

Data in transit Live

All connections to the Acreonix platform use TLS 1.3. HTTP is not accepted — all traffic is redirected to HTTPS via Vercel's edge. The HSTS header (two-year max-age) instructs browsers to enforce HTTPS even before the first redirect.

Data at rest Live

Supabase encrypts all data at rest using AES-256 at the storage layer. File uploads in the document store (leases, ID documents, invoices) are encrypted by AWS S3 server-side encryption (SSE-S3, AES-256).

OAuth tokens (Meta, WhatsApp, TikTok) Live

All OAuth access tokens and refresh tokens issued by Meta and TikTok are encrypted using AES-256-GCM with a unique 12-byte IV per token before being written to the database. The encryption key is stored as a server-side environment variable, separate from the database. This means a database breach does not expose usable tokens — an attacker would also need the application key.

Passwords Live

User passwords are hashed by Supabase Auth using bcrypt. Acreonix never sees or stores raw passwords. The bcrypt work factor is set by Supabase at a level appropriate for hardware at the time of signup, and is automatically upgraded as hardware improves.

API keys Live

API keys generated in the Acreonix Settings page are hashed with SHA-256 before storage. The hash is compared to incoming keys using a timing-safe comparison function (crypto.timingSafeEqual) to prevent timing attacks. Only the key prefix is shown in the UI after initial generation — the full key is never retrievable after the first display.

3. Access control

Row Level Security Live

Acreonix's database enforces Row Level Security (RLS) on every table. RLS policies are applied at the Postgres level — below the application layer — which means even a compromised API endpoint cannot return another organisation's data. Every read, write, and delete operation is scoped to the authenticated user's org_id.

As of 24 August 2026, all 84 active tables in the Acreonix database have RLS enabled. A full audit was completed in August 2026 covering every table added during the Content Studio and Marketing Suite builds, and any gaps were closed before deployment.

Organisation isolation Live

Each agency account in Acreonix is completely isolated. Properties, tenants, leases, leads, conversations, financial records, and connected integrations are partitioned by org_id at the database level. No query executed by one organisation can return records belonging to another — this is enforced by Postgres, not by application code.

Session management Live

Authentication is handled by Supabase Auth, which issues JWTs scoped to the authenticated user and their organisation. Sessions expire automatically. The Supabase anon key (used by the browser) can only access data permitted by RLS policies — it does not grant raw database access.

Access to production data

Access to the production database is restricted to named engineers. All schema changes and data migrations are reviewed before execution. Direct data manipulation on live user rows requires explicit authorisation.

4. API & application security

Rate limiting Live

All public-facing endpoints are rate-limited using persistent counters in Upstash Redis. Unlike in-memory rate limiting (which resets on every serverless cold start), Redis counters survive across function instances and deployments. Rate limits are enforced per IP address using fixed 1-hour windows:

• Signup — 5 attempts per IP per hour
• AI endpoints (Ask Acreonix, listing copy generation) — limited per IP per hour

Endpoints degrade gracefully if Redis is temporarily unavailable — they allow the request rather than causing downtime, which is the correct trade-off for non-authentication endpoints.

Webhook signature verification Live

All Stripe webhooks are verified using HMAC-SHA256 signature verification against the Stripe webhook signing secret before any payload is processed. Requests without a valid signature are rejected with a 400 response. This prevents webhook spoofing from external actors.

API key authentication Live

The Acreonix public REST API (used by partners to push leads and pull property data) authenticates callers using API keys. Keys are passed in the Authorization: Bearer header, validated against the SHA-256 hash stored in the database using timing-safe comparison, and scoped to the issuing organisation. An invalid key returns a 401 with no information about whether the key exists.

Content Security Policy Live

The platform applies a Content Security Policy header that restricts which origins can execute scripts, load styles, and make API connections. This limits the impact of any XSS injection — even if an attacker injects a script tag, the CSP prevents it from loading external payloads or exfiltrating data to unauthorised destinations.

Dependency management

Dependencies are pinned in package-lock.json and reviewed on update. We do not automatically apply major version upgrades without manual review. The Vercel build pipeline runs on the declared Node version to prevent supply-chain drift.

5. Compliance

UK GDPR & Data Protection Act 2018

Acreonix is incorporated in England and Wales and processes data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Our full data processing practices, lawful bases, and your rights as a data subject are documented in the Privacy Policy.

Property agencies using Acreonix to manage tenant data are Data Controllers for that data. Acreonix acts as a Data Processor under a Data Processing Agreement (DPA) included in the terms of service. Tools for data export, deletion-on-request, and audit logs are built into the platform.

PCI DSS — payments

Acreonix does not handle card numbers, CVVs, or raw financial credentials. All payment processing is performed by Stripe, which is PCI DSS Level 1 certified — the highest attainable level. Acreonix stores only a Stripe customer ID and high-level subscription metadata.

Data residency

Primary data is stored in Supabase's London region (AWS eu-west-2). The Acreonix web application is served from Vercel's UK edge. Some sub-processors (Anthropic for AI inference, Stripe for payments, Resend for email) process data in the United States under Standard Contractual Clauses (SCCs) and the UK International Data Transfer Agreement (IDTA). The full sub-processor list is in the Privacy Policy.

AI data handling

Acreonix uses Claude (Anthropic) for AI features. Prompts are processed in transit and are not used to train Anthropic's models. No tenant PII is retained by Anthropic beyond the API transaction window. Acreonix does not send raw database records to the AI — only the fields needed to generate a specific response are included in each prompt.

6. Vulnerability disclosure

If you believe you have found a security vulnerability in Acreonix, please report it responsibly:

We do not currently operate a paid bug bounty programme, but we are grateful for responsible disclosures and will acknowledge researchers by name if they wish.

7. What's coming

The following security improvements are planned but not yet live. We list them here for transparency — we will not claim them as current controls.

For security questions not covered here — including requests for a DPA, security questionnaire, or information security documentation for your procurement process — email security@acreonix.co.uk.