Security & Trust
How LeaseMate protects rental records
A plain-language account of implemented controls and what still needs operational verification.
Who operates LeaseMate
Talaat Elesh operates LeaseMate as a South African sole trader based in Pretoria, Gauteng, South Africa. Landlords entrust the service with tenant contact and identity details, leases, documents, invoices, payment records and receipts.
Account access
Landlords sign in with Google or an email one-time code, without a password. Server-side sessions can be revoked, including logout from all sessions. OWNER, MANAGER and READ_ONLY roles and account-scoped checks limit which records a signed-in person can access.
Requests and documents
Unsafe browser requests use CSRF Origin checks, and sensitive operations use rate limits. Before a stored document is retrieved from Cloudflare R2, its account ownership is checked. Uploaded identity images may be processed by Cloudflare Workers AI OCR, as described in our Privacy Policy.
Rental financial records
Landlords record rent they receive; LeaseMate does not collect tenant rent. The application preserves payment history, original receipt meaning and authoritative invoice balances. These controls have local automated tests, including payment recovery and isolation checks.
Infrastructure and operational limits
The application is configured for Cloudflare Workers, D1, R2 and Durable Objects. Local checks cover security and financial behavior. Hosted backups and restore, alert delivery, retention settings and production migration evidence are separate release checks still requiring verification. We do not claim independent security certification or uninterrupted service.
Report a security concern
Email hello@leasemate.co with a short description and safe reproduction steps. Please do not include tenant records, credentials, tokens or production customer data in your first message.
Read our Privacy Policy and Terms and Conditions for more about information handling and use.