Security and Privacy

Who Is Responsible for What

You, the developer, are the controller of your buyers’ and your team’s data under Mexico’s Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP). CasaPorte processes it on your behalf, as processor, only to provide the showroom, your team’s panel (CasaPorte Pulse) and your buyers’ app (Mi Casa).

CasaPorte makes the content and runs the platform. It has no sales agents, does not contact your leads and does not run your WhatsApp: your team runs its own panel.

CasaPorte is the controller only of what you send on this site when you book a demo (this site’s notice).

Where the Data Lives

Developments share one database: every row carries its development, and the server filters by organization and development on every request.

The move to Supabase. The database is moving from Cloudflare D1 to Postgres on Supabase, in its western United States region. The schema, its security and the demo data already live there; the published database stays on D1 until the step that publishes the move, and this page changes that day. On Supabase, CasaPorte’s server is the only door: every table has row-level security switched on with no rules, and Supabase’s public keys cannot read, write or execute anything. The database password does not live in the code.

On D1, Cloudflare places the primary copy in one of its data centers; we do not pin it to a country.

Encryption

• In transit: showroom, panel and API over HTTPS (TLS) only, terminated by Cloudflare.
• At rest: Cloudflare encrypts D1 and R2 on disk (AES-256); Supabase encrypts the database on disk (AES-256).
• Passwords: never stored. We keep a PBKDF2-SHA256 derivation with 100,000 iterations and its own salt; no one, CasaPorte included, can read them.
• Sessions and links: for sessions, invitations and password-reset links we store only their SHA-256 fingerprint, never the key.
• Service keys: Worker secrets, outside the code and the repository.
• Your WhatsApp Business token, if you connect it: encrypted with 256-bit AES-GCM and a master key that is a Worker secret; copied to another organization, it does not decrypt.
• Phone notifications: end-to-end encrypted; the browser’s notification service only sees bytes.

What is not there: field-level encryption with a key of yours. A lead’s name, email and phone are stored in the database, protected by the platform’s encryption at rest and by access control.

Signing In to CasaPorte Pulse

• CasaPorte Pulse, your team’s panel, lives on its own domain, panel.casaporte.app. Its cookie (__Host-, Secure, HttpOnly, SameSite=Strict) never travels to a showroom and JavaScript cannot read it.
• Every session expires after 12 hours. In My Profile you see your open sessions —IP, device, last seen— and close them; the Owner closes those of their team.
• After 5 failed passwords on one account, or 10 from one IP, sign-in closes for up to 15 minutes.
• Passwords are at least 10 characters. An invitation works once and expires in 7 days; a password-reset link works once and expires in 24 hours, and using it closes every other session.
• Blocking someone ends their session at once; removing them closes their account. Either way, their history stays.
• The panel cannot be framed by another site and does not send its address to the links it opens.

There is no two-factor sign-in or SSO yet.

Roles and Permissions

Each team member has one or more roles and can do the sum of their permissions. The catalog has 32 permissions in 9 groups (viewing, team, construction, inventory, sales, caseta, datos, post-venta and mi casa) and there are 7 built-in roles: Owner, Administrador, Encargado De Obra, Asesor Veterano, Asesor Nuevo, Operaciones and Propietario. The Owner edits them and creates their own.

• The server checks the permission on every request and refuses when it falls short; the panel only hides what you cannot do, it is never the barrier.
• Your team sees your organization’s developments and none from another. A sales agent sees only the leads that come through their link and their tracked links.
• CasaPorte has an administrator account, for support, that can see and change everything. What it changes goes into your audit log like anyone else’s; what it only looks at is not recorded.

Audit Log

Every successful write in the panel leaves one row: who, when, what, the before and the after, and from which IP. It never stores passwords or keys.

It cannot be edited or deleted, and not only because the panel does not offer it: the database itself prevents it. Whoever has the View Everything permission sees it, filtered by person, type and date.

Reads are not recorded: the log says who changed something, not who looked at it.

What the Showroom Measures

The showroom measures how it is browsed, so your team can follow up better:

• Levels and residences viewed and for how long; device type, browser and operating system; country (set by the network, not an exact location); and which page, campaign or link brought the visitor.
• A random number in the site’s own storage recognizes the device. No cookies, no fingerprinting and no third-party trackers. The IP is not stored with the visit.
• Personal link: when an agent sends a link with someone’s name, opening it tells the agent it is that person and shows their visit, without them signing up.
• Forms and appointments: we store what the person types (name, email, phone, message). Cloudflare Turnstile and a per-IP attempt limit protect them.

Mi Casa: Your Buyer Decides

Mi Casa is the app for people who already bought: their residence, their purchase and their payments. It lives on its own domain, app.casaporte.app, with its own cookie (__Host-cp_app, Secure, HttpOnly, SameSite=Strict) that does not open the panel; the panel’s does not open Mi Casa either. Your buyer signs in with their personal link, no password; the session lasts 90 days and they see and close their own sessions.

Your Notice, Before Anything

• Before showing a single piece of data, Mi Casa asks them to accept your company’s privacy notice, with your legal name, your address and your personal-data email. Your team publishes it, by version, in CasaPorte Pulse · Privacy.
• Without a record that they accepted your latest version, the server hands over nothing from Mi Casa. If you publish a new version, it asks again. If you have not published a notice, no one gets in.
• A record is kept of which version they accepted and when. The database prevents editing or deleting it. Your team sees it in Who Accepted and When.
• Financial data (payment receipts and, if requested for their file, bank statements or tax ID) goes in a separate, unticked checkbox. Without it, no receipts are accepted. They can withdraw it at any time.

Their ARCO Rights, Without Writing to Anyone

• When they delete their account, what is kept, without their name: their purchase and the validated payments with their receipts (your company’s contract and accounting), the audit log and the record of what they accepted and requested.
• Every request reaches your team in CasaPorte Pulse · Privacy and goes into the audit log with the customer’s number, never their email. If a deletion fails, nothing is touched, the cause is written down and your team retries it.
• No one on your team can delete a buyer’s account: only the buyer, from their own session.

◆ For your lawyer. The notice text is a draft CasaPorte writes from what the product does today. Which data serves which purpose, and how long the purchase is kept (today it says: while the contract is alive and up to 10 years after, under Mexico’s Commercial and Tax Codes) are confirmed by your lawyer before you publish it. Requests that reach you by email are answered by your team, within the legal term.

Retention and Deletion

Today there is no button to export or delete your whole development: when the contract ends, or when you ask in writing, CasaPorte does it by hand in the database and in photo and receipt storage.

Subprocessors

Who else processes personal data on CasaPorte’s behalf. Today there are two:

Both are also listed, fixed, in the privacy notice your buyer accepts in Mi Casa.

Email, WhatsApp and Phone Notifications

• Email: invitations, reset links, notices to your team and Mi Casa codes go out through whichever provider is configured, Resend or Cloudflare’s. Today the published configuration has none: no email goes out and each notice stays in the panel’s inbox. If Resend is switched on, Resend, Inc. (United States) is added here and to the Mi Casa notice before the first one is sent.
• WhatsApp: if your team connects its WhatsApp Business, notices to your agents (what happened, what was viewed and when, and the link to the lead) go out through Meta’s API with your number and your token. Meta receives them under your own account with it, not on CasaPorte’s behalf.
• Phone notifications: they travel through the browser’s notification service (Google’s, Apple’s or Mozilla’s), end-to-end encrypted: that service cannot read them.

What the Buyer’s Browser Requests

They are not subprocessors —we send them no data— but the showroom visitor’s browser requests them directly and, as with any web request, they see its IP:

• OpenFreeMap: the map tiles, only when the Location screen opens.
• CARTO: the fallback for those tiles if OpenFreeMap does not respond.
• Google Fonts: only if your brand typeface is not one we serve ourselves.
• WhatsApp: the contact buttons open WhatsApp with your team’s number; that conversation stays between your buyer and your team, outside CasaPorte.

Privacy Notices

The Showroom’s

Every showroom publishes its own at /privacidad, in Spanish and English: what is measured, what a personal link does and how to opt out with the “Borrar Mis Datos” (Delete My Data) button, which removes name and phone and leaves the visits anonymous. See Zigurat’s.

CasaPorte Pulse’s

For each member of your team who signs in to CasaPorte Pulse:

• Controller: the developer that invited you. Processor: CasaPorte, which runs the panel on its behalf.
• What is kept about you: your name and email, your password’s derivation, your roles, your sessions (IP, device type, last seen) and the audit log of what you change, with its IP.
• What for: giving you access, protecting your account and keeping a record of every change. No advertising.
• Shared with: no one outside your organization, except Cloudflare and Supabase, which host the service.
• Your rights (ARCO): access, rectification, cancellation and objection, through whoever manages your team or by writing to [email protected]. You manage your sessions and your password yourself in My Profile. The audit log is kept as your organization’s record.

Mi Casa’s

It is your company’s, and Mi Casa asks for it before anything else (how). Your team enters your legal name, address, personal-data email and phone and your own third parties in CasaPorte Pulse · Privacy; CasaPorte drafts it from what the product does: which data, what for, which uses they can refuse, who else receives it (CasaPorte, Cloudflare and Supabase, always), their rights, and what is erased and what is kept if they delete their account. You see it in Preview before publishing. It is written in Spanish. ◆ It is a draft for your lawyer.

This Site’s

What we receive when you book a demo is in the casaporte.app privacy notice.

Data Processing Agreement (DPA)

For your legal team: a template of the data processing agreement between your company (controller) and CasaPorte (processor), with the measures on this page as an annex and the subprocessor list.

Not There Yet

• Two-factor sign-in and SSO for the panel.
• The published database on Supabase (today the schema and the demo live there).
• Signing in to Mi Casa without the personal link (an email code) and a second step before seeing payments or documents.
• Exporting or deleting your whole development from the panel (today, on request).
• Automatic deletion of old visits.
• Field-level encryption with a key of yours.
• Certifications of our own (SOC 2, ISO 27001). Cloudflare, where everything runs, has them.
• External penetration testing.

Contact and Reports

For questions, exercising rights or reporting a security issue: [email protected]. If you find a vulnerability, write to us before publishing it.