Security & compliance
Compliance isn’t a checkbox we added later. It’s in the architecture: where your data lives, how it’s scoped, and how every message and role is handled.
Your data is hosted in a Canadian region (ca-central-1) so it stays in the country, a deliberate choice for PIPEDA-aligned handling.
We collect what’s needed to run your rentals, keep it scoped to your account, and treat personal information in line with PIPEDA principles.
Every commercial email and SMS carries consent tracking and an unsubscribe path. Consent is captured and honoured, not assumed.
Tenants, owners, managers, and admins each see only what their role allows, enforced on the server, not just hidden in the UI.
Every record is scoped to your account. Cross-account access is a deliberate, audited platform-admin exception, never the default.
Sensitive views and actions are recorded, so there’s a clear history of who did what and when.
Passwords are hashed, sessions are signed tokens, and email verification plus password reset are built in.
Deposit and rent-increase guidelines are surfaced for reference, as tooling, not legal advice.
Please tell us before you tell anyone else, and we will not pursue legal action over research done in good faith. Use your own account and never test in a way that could affect a real tenancy.
hello@wealtharu.comWe aim to acknowledge every report within 3 business days. We do not run a bug bounty, so there is no reward, and we would rather say so than imply one.
We use privacy-friendly, Canadian-hosted analytics to understand how Wealtharu is used and improve it. No personal information is sent, and you can change this anytime.