Built so the risky parts never touch us.

All payment processing is handled by Stripe, a PCI DSS Level 1 service provider (the highest certification level) that undergoes annual SOC 1 and SOC 2 audits. Card details are entered only on Stripe-hosted pages, and bank accounts are connected through Stripe's own verification flow.

When automatic rent payments are set up, rent moves from the payer's bank account or card into the receiver's bank account through Stripe Payments Company, a licensed money transmitter. The money never rests in an Avouch account, and Avouch never holds security deposits or escrow of any kind.

Every agreement is executed with an electronic signature flow built for the federal ESIGN Act and state UETA laws: explicit consent, a typed legal name, the signer's IP address and device, and a timestamp. The agreement's terms are fingerprinted with a SHA-256 hash at signing, and every executed agreement carries a signing certificate, so any later tampering is detectable.

All traffic is encrypted in transit with TLS. Data is stored with our infrastructure providers, which encrypt it at rest: database and file storage on Supabase, application hosting on Vercel, and transactional email via Resend. Payment webhooks are cryptographically signed and verified before anything is recorded, and production errors are reported to an error tracker.

Sessions use signed, httpOnly cookies that JavaScript cannot read, and sensitive actions are rate limited.