Security & privacy at DubaiPropertyLoan

• Email & password sign-in with rate limiting on login, signup, and password reset.
• Optional TOTP-based multi-factor authentication for all accounts.
• Role-based access (admin / broker / client) enforced in both the application and the database.
• Trusted-device tokens (30 days) with a one-click revoke endpoint.

• All traffic is served over HTTPS (TLS 1.2 or higher).
• Database and file storage are encrypted at rest by our hosting provider.
• Sensitive secrets (e.g. MFA seeds) are encrypted with application-layer AES-GCM.

The application is hosted on Lovable Cloud, which manages the underlying compute, database, storage, and networking. Compute runs at the edge; data is stored in a managed Postgres cluster.

• Row-level security is enabled on every application table containing user data.
• Brokers and clients see only records they own or have been explicitly granted access to.
• Documents uploaded to the platform are stored in private storage buckets.

The following third parties process data on our behalf:

• Lovable Cloud — hosting, database, storage, authentication.
• PayPal — subscription billing.
• Resend — transactional email delivery.
• Google Gemini — AI-assisted document analysis.

• Audit log of privileged administrative actions.
• Login-activity tracking with suspicious-country detection.
• Email-delivery log and AI-usage quota monitoring.

The hosting platform runs continuous automated backups of the production database. Our team performs periodic restore tests and records each test in an internal backup-verification log to confirm recoverability.

Customer data is retained while a workspace is active. Requests for account deletion or data export can be made by contacting our support team; we honour applicable data-protection rights.

To report a security concern or suspected vulnerability, email security@dubaipropertyloan.com. Please include steps to reproduce and allow us reasonable time to respond before public disclosure.