Security

Honest account of how DepositProof handles your data — written for buyers, not auditors.

We never touch funds: DepositProof tracks dates, photos, receipts, and math. Deposit money, rent, and bank accounts are never held, moved, or credentialed by the service.
Payments: checkout and card handling are done by Stripe; card numbers never touch our servers.
Workspace isolation: the hosted API derives your tenant from your API key — only its SHA-256 hash is ever stored — and your units and statements are visible only to your tenant. Plan unit caps and statement allowances are enforced by the API (over the cap is refused, never billed).
Your evidence exports with you: on cancellation, your data exports on request today; self-serve vault export (CSV + photo ZIP) is on the roadmap — we don't hold documentation hostage.

We are not SOC 2 certified and have not completed a third-party penetration test. We'll say so plainly until we have.
DepositProof is not legal advice and its dataset is compiled from published secondary sources; confirm state specifics with local counsel.

Email don+depositproof@lifeofmorr.com with details. We aim to acknowledge within 2 business days.