QuickCasa handles rental enquiries, tenant records and, through QuickPass, the financial information renters use to prove they can afford a home. This centre sets out where that data lives, who can reach it, how long we keep it, and who we rely on to run the service. Everything here is drawn from the policies published below, and every claim is one we can evidence.
Production runs in separate Canadian and United States cloud projects, with separate credentials, service accounts and secrets. Customer data stays in the region it was provisioned in.
TLS 1.2 or higher in transit, with plain HTTP refused or redirected. AES-256 at rest across primary storage, replicas and backups. Credentials and other restricted data get a second layer of envelope encryption through Cloud KMS.
Every account is individual and tied to a company identity. Cloud IAM bindings, administrator lists and vendor dashboards are reviewed at least quarterly, and access is revoked on the day a person leaves.
Firestore is backed up on a schedule with point-in-time recovery, inheriting the encryption and access controls of the source data. Recovery point objective of 24 hours or better, recovery time objective of 8 hours for core services. Restores are tested at least annually.
Production surfaces are checked every five minutes from inside each region, and the results are published as they are recorded. Current status, 90 days of uptime and any incidents are open to anyone at status.quickcasa.ai, with no sign-in required.
A customer whose data or service is affected is told without undue delay, and within 72 hours of a confirmed breach of personal information. Individuals and the Office of the Privacy Commissioner of Canada are notified where the breach creates a real risk of significant harm.
Every category of data has a defined retention period and a named owner. Deletion requests are honoured within the statutory window, and data in backups is overwritten as those backups age out rather than lingering indefinitely.
No customer or renter data is ever used to train a third-party model. Generated replies are checked against real inventory and configuration before they are sent, and no model output decides who is offered housing.
All services write structured logs to Google Cloud Logging, retained for a minimum of 30 days. Logs are never used to store restricted data.
Our policies are written against PIPEDA, applicable provincial privacy legislation including Quebec's Law 25, and applicable United States state privacy law.
QuickCasa runs on Google Cloud Platform. Google Cloud maintains SOC 1, SOC 2, SOC 3, ISO 27001, ISO 27017, ISO 27018 and PCI DSS certifications for that infrastructure, and QuickCasa relies on them for physical security, hardware lifecycle and data-centre operations. Those are Google's certifications covering Google's infrastructure. Where a reviewer needs evidence about QuickCasa's own controls, the policies below are that evidence, and we will answer anything they do not cover.
Public surfaces sit behind Cloudflare for DDoS mitigation, TLS termination and a web application firewall. Serverless and managed services are preferred throughout, so operating-system patching and runtime security are handled by the provider rather than by us.
These are the principal third parties that process data on QuickCasa's behalf. Each is reviewed before engagement and recorded in our vendor register with the data it processes and the person responsible for it. Sub-processors are not permitted to retain QuickCasa data for their own purposes. The complete register is available to customers on request.
| What it does | Provider |
|---|---|
| Cloud hosting, database, file storage, authentication, key management and logging | Google Cloud Platform and Firebase |
| Edge protection, DNS and TLS termination on public surfaces | Cloudflare |
| Voice calls and SMS | Twilio |
| Transactional and outbound email | SendGrid |
| Payments and billing | Stripe |
| Bank account verification inside QuickPass | Plaid |
| Large language model inference for the AI leasing features | OpenRouter, OpenAI and Google |
| Speech synthesis for the voice agent | ElevenLabs |
| Hosting of our published privacy policy and terms of service | Termly |
| Source control for the platform's code | Bitbucket |
Our Information Security Policy, Data Retention and Disposal Policy, Responsible AI Policy, Vulnerability Disclosure Policy, Privacy Policy and Terms of Service are published in full. Each one names the person who owns it, the date it took effect and the date it was last reviewed.
Read the policiesIf your security review needs something this centre does not cover, write to info@quickcasa.ai and it will reach the CTO.
If you believe you have found a vulnerability in a QuickCasa product, our Vulnerability Disclosure Policy sets out how to report it, what we commit to doing about it, and the safe harbour we extend to good-faith research.