BlockManOSJoin the waitlist
BlockManOS processes personal data for unit owners, OMC directors, tenants, and contractors — all subject to GDPR and the Irish Data Protection Acts. Here is what we actually do to protect it.
[ AUTHENTICATION — ALWAYS ON ]
Every session is authenticated. Agents, directors, and owners each have their own scoped portal — agents via a full dashboard, OMC directors via a dedicated board portal, and unit owners via a token-gated owner portal — so no one ever sees data outside their own development or role.
Role-based access Owner, admin, and member roles enforced at the organisation level
Per-portal token isolation Owner portal and director portal access is gated by short-lived tokens, not shared logins
Audit log Every significant action is recorded with actor, timestamp, and affected record
[ AML COMPLIANCE ]
Irish law requires Anti-Money Laundering checks on OMC directors, secretaries, and any owner who is also a landlord client. BlockManOS provides a dedicated AML module capturing full name, date of birth, nationality, occupation, PPS number, proof of ID, proof of address, and a full list of other directorships — all stored per individual, not per file.
Sensitive fields are held in a purpose-built structure, not in generic notes. Access is restricted by role.
[ WHAT WE DO NOT CLAIM ]
Some platforms display compliance badges they have not earned and certifications that do not apply to their actual scope. We prefer to tell you what we have built.
Authentication and role-based access, multi-tenant data isolation with org-level scoping, an audit log, a dedicated GDPR module, AML record management, signed webhook verification, and token-gated owner and director portals.
Deeper RLS (row-level security) enforcement at the database layer, expanded GDPR self-service tooling for data subject rights, and formal penetration testing. We will update this page as controls ship.
[ EARLY ACCESS ]
If you have a security or data protection question that this page does not answer, email us at sf-core-org-support-blockmanos@saas-factory.ai — or join the waitlist below and raise it when we get in touch.
[ DATA HANDLING ]
BlockManOS has a dedicated GDPR management module within the platform. It exists because the platform processes highly sensitive personal data: PPS numbers, AML identity documents, ownership records, and correspondence histories.
A dedicated GDPR section in the dashboard for managing data subject requests and consent records — not buried in settings.
AML documentation for OMC directors, secretaries, and landlord clients — including ID, proof of address, PPS numbers, and directorship declarations — stored in a structured, role-gated module.
[ MULTI-TENANT ISOLATION ]
BlockManOS is a multi-tenant platform. Every development, unit, owner record, service charge demand, and document is scoped to the managing agent's organisation. Application-level filtering enforces that no agency can ever retrieve another's data.
[ INTEGRATION SECURITY ]
The QuickBooks integration receives payment status updates via webhook. Webhook payloads are verified using HMAC-SHA256 signature validation — if the verification token is absent or the signature does not match, the request is refused with a 503 response. Unverified webhook payloads are never processed.
Signed webhook enforcement QuickBooks webhooks rejected if HMAC-SHA256 signature cannot be verified
agentOS bi-directional sync Data exchange with agentOS is scoped — only linked records propagate
API keys Programmatic access is controlled via issued API keys, not shared credentials
[ SECURITY FAQ ]
Documents are stored with role-based visibility. Agents, owners, and directors see only what they are permitted to see within their own development scope.
Every domain table — developments, units, owners, compliance obligations, maintenance requests — carries an organisation ID that is validated on every query.
Three permission tiers (owner, admin, member) control what each team member can create, edit, or view within their own organisation.
A full audit log records who did what and when — so agents and administrators can trace every action taken on any record.
