Security

All traffic to and from My5thStar is served exclusively over HTTPS (TLS 1.2+); we do not accept unencrypted connections. Data at rest is encrypted (AES‑256) by our managed database provider.

Application data is stored in a managed PostgreSQL database currently hosted in Frankfurt, Germany (eu‑central‑1), served through Vercel’s global edge network, with media (property photos and documents) held in the same region. We handle personal data in line with the data-protection laws applicable in the markets we serve, and can discuss specific data-residency requirements with enterprise customers.

My5thStar is multi-tenant: every agency’s data is separated from every other agency’s. Isolation is enforced by application-level tenant scoping on every request and by database row-level security. Access requires authentication, with role-based permissions; programmatic access uses per-tenant secret API keys that resolve to a single agency.

Every change to our code is automatically checked before it can ship: we scan for accidentally-committed secrets and for known vulnerabilities in our dependencies, and a change cannot be deployed if a check fails. Dependencies are additionally re-scanned on a weekly schedule, with fixes reviewed and applied on an ongoing basis.

We carry out regular internal security reviews focused on access control and cross-tenant data isolation, and remediate findings before they can affect customer data. (We do not currently publish third-party penetration-test reports; where that changes, this page will say so.)

We maintain a documented incident-response process covering detection, containment, notification, recovery, and a post-incident review. If a security incident affects your data, we will notify affected customers without undue delay and share what we know and what we are doing about it.

If you believe you have found a security issue, please tell us — we welcome responsible disclosure and will work with you in good faith. Email reviews@my5thstar.com with the details and steps to reproduce. Please give us a reasonable window to investigate and fix before any public disclosure, and do not access or modify data that isn’t yours while testing.