Security

What we store, and what we never touch.

TrustRec's security story is simple because its scope is narrow: you upload report exports you already produce, and we turn them into a signable PDF. We never connect to your bank.

What we never touch

No bank login credentials — ever. There are no bank feeds and no Plaid. We cannot move money and have no path to your online banking.
Not your full account number. We store only the last four digits, masked (for example ••••6601), so you can tell your accounts apart.
No Buildium access. You export the reports; we only see the files you upload.

What we store

The report exports (CSV) you upload, kept as the audit trail behind each package.
The generated reconciliation PDF packages.
Your email address (used for sign-in) and each trust account's name, bank name, and masked last-four.
The exceptions we flag and the explanations you write for the signed package.

How it's protected

Encrypted in transit. The whole app is served over HTTPS; plain HTTP is redirected.
Encrypted at rest. Your files, the database, and the generated packages live on encrypted storage volumes.
Sign-in without passwords. We use single-use, 15-minute magic links, so there is no password to leak. Sign-in tokens are stored only as hashes.

How long we keep it

North Carolina requires trust account records to be retained for at least three years (21 NCAC 58A .0108), and a reconciliation is only useful if it's there when an examiner asks. So we keep your packages and their source files for that look-back window. Cancelling your subscription never deletes or hides past reconciliations — you can always sign in and download them.

We will delete your account and its data on request, once you've downloaded anything you need to retain under your own obligations. Email the founder and we'll confirm.

Who else is involved

We keep the vendor list short and name it plainly: hosting (Fly.io), transactional email (Resend), and payments (Paddle, as merchant of record — your card details go to Paddle, never to us). That's the whole list.

Questions a customer or their attorney should ask, we're happy to answer directly. This page describes current practice for the North Carolina · Buildium product and is not a contract; see Terms and Privacy.