Security
Every workspace is isolated
A workspace's records live in their own space in the database. Who may read and write them is decided by the database's security rules — not by the app — and those rules check both your sign-in and your current membership of the workspace. A suite of tests runs the rules against the database emulator on every release, including attempts to read another workspace, to use a forged or stale membership, and to reopen a lapsed workspace from the browser.
The ledger checks itself
Money is recorded in kobo as balanced double-entry journals. The engine verifies that the books balance and that money held for others (deposits, escrow) is kept apart, on every change. Receipts and gate passes carry a reference anyone can verify.
Access
Passwords are handled by Google Firebase Authentication and never stored by us. Removing a team member revokes their sessions at once. Escrow releases need two different approvers. Subscription payments are taken by Flutterwave and Stripe — card numbers never reach Real+.
In transit and at rest
All traffic uses HTTPS with HSTS. Data is encrypted at rest by Google Cloud. Pages carry a strict Content Security Policy.
AI
Ask Real+ sends Claude totals only — never names, phone numbers or documents — and each workspace has a daily limit.
Reporting a vulnerability
Email support@korevra.com with the subject "Security". Please give us a reasonable time to fix an issue before disclosing it.