How we protect your HOA's data

Last updated: June 26, 2026

A plain-English look at where your data lives, who can see it, and how it's protected.

Your money is handled by Stripe, not us

When members pay dues by credit card or bank transfer, those details go straight to Stripe — the same payment company trusted by companies like Shopify, Lyft, and Peloton. Card numbers and bank account details are never stored on Fourplex servers. Stripe is certified to the highest industry standard for handling payments (PCI DSS Level 1). Stripe's handling of payment data is governed by Stripe's Privacy Policy.

Your data is encrypted

All communication between you and Fourplex is encrypted in transit using HTTPS. All data we store is encrypted at rest using AES-256 — the same encryption standard used by banks and the US government. Sensitive secrets like bank login credentials and full account numbers are never stored by Fourplex at all — they stay with Stripe.

Everything is hosted in the United States

Fourplex's servers, databases, backups, and payment processing all live in the United States, and your HOA's stored data stays in the country. Some of the providers we rely on operate global networks that may route a request through another region to deliver content quickly, but the data we store on your behalf does not leave the United States.

Sign in without passwords, with optional two-factor authentication

We don't store passwords — which means we can't lose them. Sign-in uses a one-time magic link emailed to you. For additional protection, any user — board member or regular member — can enable two-factor authentication in their account settings.

Your HOA's data is isolated from every other HOA

Every HOA on Fourplex has its own space in our database, enforced by the database itself (not just by our app code). Board members see their community's data. Members see what their board has shared with them. Nobody else can access it.

If your HOA connects a bank account, the connection is read-only

Bank connections use Stripe Financial Connections. They let your board pay dues by bank transfer (ACH) and see a read-only view of bank balances and transactions. Fourplex never stores your bank login credentials and cannot move money out of a connected account. You can disconnect a linked account at any time.

Our AI assistant can't train on your data

Some communities use Neo, our optional AI assistant. Neo is read-only — it can look up and summarize your community's information, but it can't create, change, or delete anything. When you ask Neo a question, the relevant information is sent over an encrypted connection to an external AI model under zero-data-retention terms, which means the provider does not keep it or use it to train its models. Fourplex never uses your data to train AI models. Neo can make mistakes, so always verify important answers against your official HOA records.

We mask sensitive content in diagnostics

To fix problems and improve the product, we record anonymous usage analytics and occasional screen sessions. We deliberately mask sensitive content — including form inputs, email message bodies, document previews, financial amounts, and maintenance-request text — so it is never captured. Analytics and error reports are keyed to an opaque identifier, not your name or email.

Daily automated backups

Your records are backed up automatically every day, so a mistake or accident never means starting from scratch.

Built on trusted infrastructure

We partner with industry leaders for our core infrastructure, and the providers we rely on maintain SOC 2 Type 2 and PCI DSS certifications — meaning their security practices are independently audited every year. This lets a small team like ours offer the same security posture as much larger companies. You can see the full list on our Subprocessors page.

What we don't do

• We don't sell your data.
• We don't share your HOA's data with advertisers.
• We don't store your members' bank account or credit card numbers.
• We don't use your data — or your HOA's data — to train AI models.
• We don't display ads on any Fourplex site or inside the app.

Found a security issue? Let us know.

We welcome responsible disclosure from security researchers and customers. Email security@getfourplex.com and we'll respond within two business days.