Your community’s data, treated like it matters

All traffic to HostedHOA — on hostedhoa.com and on every community’s custom domain — is served over HTTPS, fronted by Cloudflare’s global network. Strict security headers (HSTS, a content-security policy, clickjacking protection) ship on every page.

Passwords are hashed with bcrypt before they ever touch the database — we cannot read them, and neither can anyone else. Sign-in and password-reset endpoints are rate-limited to shut down credential-stuffing attempts.

Sessions use signed, httpOnly cookies with built-in versioning: changing your password or clicking “sign out everywhere” instantly revokes every other device’s access — not just the one in your hand.

Every member can protect their account with authenticator-app two-factor authentication (TOTP), with single-use recovery codes for safekeeping. We strongly encourage it for board members and administrators.

HostedHOA is multi-tenant with isolation enforced in every database query: each record belongs to exactly one community, and every read and write is scoped to it. One association can never see another’s members, documents, or finances.

Dues and donations are processed by Stripe, a PCI-DSS Level 1 certified payment processor. Card numbers are entered on Stripe’s hosted checkout and never touch our servers — we store only the amount, status, and a reference.

The database is backed up automatically every night, with backups retained for 14 days — so an accidental deletion or a bad day never becomes a lost year of community records.

No lock-in, ever. Administrators can download a complete export of their community’s data — members, documents, finances, everything — in open formats, anytime, with one click from the admin settings.