Scope
Propty's processing of personal data on behalf of your firm under the master services agreement.
Categories of data subjects
Your tenants, applicants, prospects, vendors, staff, and owners whose data is processed in Propty.
Categories of personal data
Contact info, identifiers, financial info, lease history, communications, biometric data (only where consented), location data.
Processor obligations
Confidentiality, security measures (Annex II), sub-processor list (linked), assistance with DSARs, audit rights.
Sub-processors
Listed publicly at /sub-processors. 30 days notice before adding new ones. Data subject rights
Self-service via /api/data-export. SAR, deletion, rectification, restriction supported.
Data residency
US (us-east-1) by default. EU residency available on Scale tier under separate addendum.
Security
Encryption at rest (AES-256), encryption in transit (TLS 1.3), RLS-enforced access, audit logging, daily backups, annual pentest.
Breach notification
Within 72 hours of confirmation. Includes nature, categories, approximate numbers, likely consequences, mitigation measures.
Term + termination
Co-terminus with MSA. On termination: data exported within 24 hours (self-service ZIP), then deleted within 30 days.