Security
Built so the risky parts never touch us.
Avouch exists to make subletting safe, so the product is designed around a simple rule: the most sensitive things, your card numbers, your bank login, your money, are handled by regulated specialists and never stored by Avouch at all.
Payments run on Stripe
All payment processing is handled by Stripe, the payments provider behind millions of businesses. Stripe is a PCI DSS Level 1 service provider (the highest certification level) and undergoes annual SOC 1 and SOC 2 audits. Card details are entered only on Stripe-hosted pages, and bank accounts are connected through Stripe's own verification flow. Card numbers, bank logins, and account numbers never touch Avouch's servers.
When automatic rent payments are set up, rent moves from the subletter's bank account to the lister's bank account through Stripe Payments Company, a licensed money transmitter. The money never rests in an Avouch account, and Avouch never holds security deposits or escrow of any kind.
What we store, and what we never store
To run your sublease, we store: names, email addresses, the property address and sublease terms, signature records, timestamped move-in photos, and payment schedule status. For linked banks we store only the bank's name, the last four digits, and Stripe's reference tokens.
We never store card numbers, bank usernames or passwords, full account or routing numbers, or Social Security numbers. We have no ads and we do not sell personal information.
Signatures you can prove
Every agreement is executed with an electronic signature flow built for the federal ESIGN Act and state UETA laws: explicit consent, a typed legal name, the signer's IP address and device, and a timestamp. The agreement's terms are fingerprinted with a SHA-256 hash at signing, and every executed agreement carries a signing certificate, so any later tampering is detectable.
Infrastructure
All traffic is encrypted in transit with TLS. Data is stored with our infrastructure providers, which encrypt it at rest: database and file storage on Supabase, application hosting on Vercel, and transactional email via Resend. Payment webhooks are cryptographically signed and verified before anything is recorded, and production errors page us through independent monitoring.
Sessions use signed, httpOnly cookies that JavaScript cannot read, and sensitive actions are rate limited.
Found something?
If you believe you've found a security issue, email support@avouchsublease.com and we will respond quickly. Please include enough detail to reproduce what you found.
See also our privacy policy and terms of service.