Security

Overview

Tecurve is built on established, managed cloud infrastructure, with security applied in layers rather than relying on any single safeguard. In practice, that means:

• Your connection to Tecurve is always encrypted.
• Your data is isolated so that only your account can access it.
• Your password is protected using industry-standard hashing and is never stored in a readable form.
• Your data is encrypted at rest and backed up securely.
• We use no advertising or tracking scripts, and we do not sell your data.

Infrastructure and Hosting

Tecurve runs on trusted, industry-standard managed cloud providers rather than self-managed servers, so your data benefits from their scale and security practices. These providers cover:

• A managed database, authentication, and application-backend platform.
• A global content-delivery and edge network for secure delivery of the application.
• A specialist provider for transactional emails such as verification, password-reset, and reminder messages.

Access to the underlying infrastructure is restricted and protected by each provider's own security controls.

Encryption

In transit. All traffic between your browser and Tecurve — and between Tecurve and its service providers — is encrypted using HTTPS/TLS. Your data is never transmitted over an unencrypted connection.

At rest. Your data is encrypted at rest by our managed database provider. In addition, our backups are independently encrypted using AES-256 encryption before they are stored, and the encryption keys are kept separately from the backups themselves.

Data Isolation and Access Control

• Tecurve is a single-account-per-user product: each account only ever sees the data entered under that account. There is no shared or pooled data between accounts.
• Access rules are enforced at the database layer, so every request is automatically restricted to the data owned by the signed-in account. This protection does not rely on the front-end alone, which means a mistake in the interface cannot expose another account's data.
• The small number of sensitive operations that need elevated access run only on our secured backend, never in code that runs in your browser.

Authentication

• Accounts sign in with an email address and password through our authentication provider.
• Passwords are stored only as a salted hash — never in plain text — and Tecurve never sees or stores your password in a readable form.
• We enforce a minimum password strength: at least 8 characters, including uppercase and lowercase letters, a number, and a symbol.
• New accounts must verify their email address before the account can be used.
• If you forget your password, recovery uses a single-use link sent to your email — our team cannot see or reset your password directly.
• Deleting your account requires re-entering your current password as an extra confirmation, so a signed-in device left unattended cannot be used to delete your account without knowing the password.

Backups and Recovery

• Tecurve takes automated, encrypted backups of the database on a regular schedule.
• Backups are encrypted with AES-256 before they are stored, and each backup is automatically verified to confirm it can actually be restored — not just that it was created.
• Backup encryption keys are stored separately from the backup files, so the backups are unreadable without the corresponding key.

Application and Development Security

• Secret keys and credentials are stored securely on the server side and are never included in the code that runs in your browser.
• Information submitted to Tecurve is validated before it is processed, and error messages shown to users are generic — internal system details are never exposed.
• Public forms (such as our contact form) are protected against automated abuse using bot-verification and rate limiting.
• Changes to the database structure are made through version-controlled, reviewable updates rather than ad-hoc manual changes, giving us a clear, auditable history.

Keeping Your Account Secure

Security is a partnership. You can help protect your account by following a few simple practices:

• Use a strong, unique password that you don't reuse on other websites.
• Keep the email address on your account secure — it is both your login identifier and where password-reset links are sent.
• Sign out of Tecurve on shared or public computers.
• Be cautious of phishing: Tecurve's genuine emails are sent from the mail.tecurve.com domain, and we will never ask for your password by email.
• Remember that anyone who knows your password can access — and delete — your account, so protect it accordingly.
• Handle exported files carefully. Excel and PDF exports are downloaded to your own device, are not encrypted, and can contain personal data such as tenant names and contact details. Save them somewhere secure, avoid sending them over unsecured channels, and delete them once you no longer need them.
• When you record information about tenants or co-occupants, make sure you have a lawful basis to do so. See our Privacy Policy for details.

Reporting a Security Issue

If you believe you have found a security vulnerability in Tecurve, please report it to us privately so we can investigate and address it:

• Email: contact@tecurve.com — please include a clear description of the issue and the steps to reproduce it.

We ask that you do not publicly disclose the issue before we have had a reasonable opportunity to respond, and that you do not access, modify, or delete data that does not belong to you while investigating.

How We Describe Our Security

We aim to describe our security measures accurately and only in terms of controls we actually have in place. We do not use exaggerated marketing language or claim security certifications that we do not hold. As Tecurve grows, we will continue to strengthen these measures, and we will keep this page up to date.