Security
How money and data move through the product.
The product is being built to move rent payments and hold bank account details for owners and agencies. That is a different trust boundary than software that only reads data, so the handling model is published before the product ships rather than after.
Handles
- Rent payment events from the payment processor, matched to unit and owner.
- Owner and agency bank account details, used only to route payouts.
- Amounts and dates needed to calculate tax withholding and commission split.
Never holds or does
- Customer funds directly. Money moves through a licensed payment processor; Rexia does not custody cash balances.
- Card numbers or full account credentials in application storage — payment details are tokenized by the processor, not stored raw.
- Any write path that moves money without a corresponding collection or settlement record behind it.
Funds move through a licensed processor
Rent is collected and disbursed through a licensed payment processor. The product does not hold customer balances; it instructs and records what the processor already regulates and moves.
This keeps custody of funds with an entity built and licensed for it, and keeps the product's scope where the actual gap is: the tax and settlement logic on top.
Card and bank data are tokenized
Payment details are tokenized at the processor. The product stores references to a token, not raw card numbers or full account credentials.
Bank account details needed for owner payout are encrypted at rest and scoped to the settlement job that needs them.
What is stored
The working set is the data needed to run a settlement: property, owner, rent amount, tax withholding calculation, commission split, and payout status.
Transactional records live in Postgres; documents and generated tax reports are stored separately with access scoped per agency.
Where it runs
The product's infrastructure runs on AWS. Encryption keys and secrets are managed through KMS and Secrets Manager, and access to funds-moving code paths is logged for audit through CloudWatch.
This website is a static export with no server runtime, no database, and no session state. It cannot receive payment or bank account data.
What is not claimed
REXIA holds no banking license and no PCI-DSS Level 1 attestation, and does not claim one. The product is designed to keep funds custody and cardholder data out of its own scope rather than to claim a license it does not hold.
This page describes the handling model the product is built against. It is a commitment about scope, not a report on an audited system.
Reporting a vulnerability
Send findings to security@rexia.io. Reports are read by the engineer who wrote the code. Machine-readable contact details are published at /.well-known/security.txt as described in RFC 9116.
security@rexia.io