Rentakoto
On this page
  1. Our commitment
  2. Encryption
  3. Account security
  4. Payment security
  5. Identity documents
  6. Platform hardening
  7. Reporting a vulnerability
  8. Protecting your account
  9. Contact

Security at Rentakoto

Effective Date: July 15, 2026  ·  Version 1.0

1. Our Commitment

Rentakoto handles things that matter: your identity documents, your rent payments, your security deposits, and your signed rental agreements. Protecting that information is a core part of how we build and operate the platform, not an afterthought.

This page describes the security measures we apply across the platform and explains how to report a vulnerability to us. It complements our Privacy Policy, which describes what data we collect and why.

2. Encryption in Transit and at Rest

  • All traffic between your browser and our servers is encrypted with HTTPS/TLS. Our production services enforce HTTP Strict Transport Security (HSTS), so browsers refuse to connect insecurely.
  • Uploaded files (identity documents, contracts, property photos, and avatars) are stored in encrypted S3-compatible object storage.
  • Access to stored files is controlled through time-limited signed URLs; files are never exposed at public, guessable addresses.

3. Account & Sign-In Security

  • Passwords are protected with industry-standard one-way hashing and are never stored or logged in plain text.
  • You can sign in with Google (OAuth), in which case Rentakoto never sees or stores a password for your account.
  • Sessions use HTTP-only cookies that cannot be read by scripts running in the page, limiting exposure to cross-site scripting attacks.
  • State-changing requests are protected against cross-site request forgery (CSRF).
  • Password reset links are single-use and time-limited.

4. Payment Security

  • Full payment card numbers never touch Rentakoto's servers. Cards are tokenized directly by our PCI DSS–compliant payment processors: Stripe (international card payments) and Xendit via the NovusX payment gateway (local Philippine methods such as GCash, Maya, and bank transfers).
  • We store only what is needed to show you your payment history: card brand, last four digits, expiry, and transaction references.
  • Security deposits are managed through a dedicated escrow workflow with a recorded, auditable release process; deposits are not simply passed between users.
  • Fraud screening on card and wallet transactions is performed by the payment processors as part of every charge.

5. Identity Document (KYC) Handling

  • Identity verification is performed by our specialist partner, InnovatorX (Profile Check service). Documents are transmitted to them over encrypted connections.
  • Copies retained by Rentakoto are kept in encrypted storage, only for as long as compliance and dispute-resolution obligations require, as described in the Privacy Policy.
  • Access to verification documents is restricted by role: only authorized administrative staff involved in verification can view them.

6. Platform & Infrastructure Hardening

  • Every API response carries OWASP-recommended security headers, including a strict Content-Security-Policy, X-Content-Type-Options: nosniff, X-Frame-Options: DENY, and a locked-down Referrer-Policy.
  • Role-based access control (Renter, Landlord, Service Provider, Admin) is enforced server-side on every request and covered by automated security tests that run before changes ship.
  • Internal service-to-service calls (for example, between the platform and the payment or messaging services) are authenticated with dedicated API keys; being inside our network is not enough.
  • The platform runs on managed cloud infrastructure with TLS termination, isolated environments for testing and production, and continuous availability monitoring.
  • Dependencies and code changes go through automated linting, testing, and review before deployment.

No security measure is absolute. If we become aware of a breach that affects your rights, we will notify you as required by applicable law.

7. Reporting a Vulnerability

We welcome reports from security researchers and users. If you believe you have found a vulnerability in Rentakoto, please tell us privately before disclosing it publicly.

Please include enough detail for us to reproduce the issue: the affected URL or feature, steps to reproduce, and the impact you believe it has. We will acknowledge your report within 5 business days, keep you informed as we investigate, and let you know when the issue is resolved.

We ask that you research in good faith:

  • Do not access, modify, or delete data belonging to other users — use your own test accounts.
  • Do not degrade the service for others (no denial-of-service, spam, or automated scanning at disruptive volume).
  • Do not use social engineering, phishing, or physical attacks against Rentakoto staff or users.
  • Give us a reasonable opportunity to fix the issue before any public disclosure.

We will not pursue legal action against researchers who follow these guidelines in good faith. We do not currently operate a paid bug bounty program, but we are grateful for responsible reports and will acknowledge your contribution if you wish.

8. Protecting Your Account

Security is shared. A few things you can do:

  • Use a strong, unique password for Rentakoto, one you don't use anywhere else.
  • Rentakoto staff will never ask for your password, one-time codes, or full card number. Report anyone who does.
  • Keep payments and conversations on the platform. Requests to pay outside Rentakoto (direct bank transfer, gift cards, crypto) are a common scam pattern.
  • Check the address bar before signing in or paying: it should always be a rentakoto.com address served over HTTPS.
  • Report suspicious listings, messages, or users through the in-platform reporting tools or our contact page.

9. Contact