Security

What we are protecting

Three things, in this order: an agent's account, the licensed MLS data behind their reports, and the reports themselves once a client is holding a link to one.

This page says what is actually in place. It is not a certification claim, and where something is a deliberate limit rather than a feature we say so.

In transit

Every connection to reportpoppy.com is HTTPS. The phone apps are native shells around the same authenticated site, so a report on a phone travels the same encrypted path it does in a browser, and the apps carry no separate copy of the data.

Accounts and sessions

• Passwords are never stored. They are hashed with scrypt and a per-account salt.
• A session is a 256-bit random token in an HttpOnly, SameSite=Lax cookie. Page scripts cannot read it.
• Sign-in attempts are throttled per account. The credential is checked before the limit is applied, so nobody can lock an agent out of their own account by guessing at it.
• Poppy ID is the suite's single sign-in. Its bearer token is a second credential on the same session, and the sign-in round trip stays inside the app rather than finishing in another browser.

One agent, one account

Reports, uploaded photographs, property files and share links are owned per agent. Another agent signed in to the same server cannot list them, open them, or serve media out of them. A client link resolves only to the listings inside that link's own frozen snapshot.

The MLS boundary

Licensed MLS content stays inside the report product. There is no bulk export, no public API over the feed, and the phone apps deliberately hold none of it. An agent's right to pull data ends when their MLS access does.

Payments

ReportPoppy does not see, handle, or store card numbers. Subscription billing runs through the payment processor, and what comes back to us is a subscription state, not a payment instrument.

Hosting and data at rest

The application runs on a dedicated Linux host behind nginx, in the United States. Application data lives in files on that host, outside the deployment path so a release cannot overwrite or delete it. Backups are the operator's responsibility and are held off the host.

An honest limit: this is a small, focused product, not a multi-region platform. If the host is down, ReportPoppy is down, and the app says so rather than showing an empty report.

Reporting a problem

If you have found a way to reach something you should not, read Responsible Disclosure and write to us with "Security" in the subject line. We answer those first and we offer safe harbour for good-faith research.