Security Policy

1. Encryption in transit

• The web application, the mobile applications and the API are served over HTTPS only. There is no unencrypted route into the service.
• Connections between our application servers and our database are encrypted.

2. Encryption at rest, and the fields we treat as sensitive

• Identity card numbers and bank account details — the fields that carry the most risk to an individual under the Personal Data Protection Act 2010 — are encrypted at rest with AES-256-GCM.
• Every read that decrypts one of those fields is written to the audit trail, with who read it and when. Encryption without a record of access answers the wrong question.
• Passwords are never stored. They are hashed with argon2, so a copy of our database does not yield anyone's password.

3. Workspace isolation

Prop Elite is used by many agencies on shared infrastructure, so keeping one agency's records unreachable by another is the platform's central obligation.

• Every record belongs to exactly one workspace, and the workspace is applied to every database query by the platform itself rather than by each feature remembering to add it.
• Which tables are protected this way is asserted by an automated test against the product's own database schema, so a new table cannot quietly join the service without isolation.
• Within a workspace, what each member may see is decided by their role — an agent sees their own records, a team leader their team's, an owner the agency's.

4. Accounts and access

• Two-factor authentication (TOTP) is available to every user and can be switched on from account settings.
• Sign-in attempts are rate-limited, so a stolen email address cannot be used to guess a password at speed.
• Changing or resetting a password immediately ends every other session and revokes any connected application's access.
• Password reset links are single-use and expire within 24 hours. When you reset your own password, the link goes to your email address and nowhere else: the token is never returned in a web response.
• An administrator in your own agency can also issue a reset link for a member below their own rank and receive the link to hand over. That is deliberate, it can never be used against an account that outranks the person issuing it, and it is recorded in your audit trail.

5. Payment data

We never receive, see or store your banking credentials. Payment is completed on our provider's own secure checkout page, and what returns to us is confirmation that a payment succeeded and for how much. See the Payment Policy.

6. Our access to your data

• Routine support does not require access to your records. Where a problem cannot be diagnosed without it, a named administrator may open a support session into your workspace.
• A support session requires a written reason, is limited to 30 minutes, and every action taken during it is stamped in your audit trail as having been performed under that session.
• Your agency can switch support access off entirely, and we will diagnose without it.

7. Audit trail

Sensitive changes — permissions, commission rules, member status, decrypting reads of personal data, and every action taken during a support session — are recorded with the person, the time and what changed. The trail is visible to your agency's administrators, not only to us.

8. Backups and availability

• The database is backed up automatically by our hosting provider.
• Uploaded files are stored on managed object storage rather than on an application server, so a server can be replaced without data loss.
• Availability and response times are monitored continuously, with alerts to us when the service is slow or unreachable.

9. Where your data is held

The service is hosted with DigitalOcean. Some processing and storage takes place outside Malaysia; which categories of data, and the safeguards that apply, are described in the Privacy Policy under transfers outside Malaysia.

10. Reporting a vulnerability

If you believe you have found a security weakness in Prop Elite or on aetherailabs.net, write to [email protected] with enough detail to reproduce it. We will acknowledge within 2 working days and keep you informed until it is resolved. We will not pursue anyone who reports a genuine issue to us in good faith and does not access or alter other people's data.

11. If something goes wrong

If a breach affects your agency's data, we will tell you what happened, what data was involved and what we are doing about it, without waiting until the investigation is finished. Our obligations to you under the Personal Data Protection Act 2010 are set out in the Privacy Policy.