Skip to content
Home

Trust & security

MoveGuard is only useful if both sides can rely on the record. Here is exactly how we make that possible.

Tamper-evident records

  • • Every original file gets a SHA-256 fingerprint, calculated on the phone and again on our servers; they must match.
  • • Confirming a walkthrough seals it: the snapshot can't be edited by anyone, including MoveGuard staff.
  • • Each sealed snapshot is timestamped by an independent authority (RFC 3161), with a backup authority if the first is down.
  • • Anyone can check a packet, archive, or original photo at /verify. Files are hashed in the browser and never uploaded.
  • • Packets show whether each photo was taken live in the app or uploaded from a library, and flag metadata worth a closer look.

Access and privacy

  • • Database rules enforce that each renter can only read their own records; business data is only reachable through checked API calls.
  • • Photos are stored in a private bucket and shared only through short-lived signed links.
  • • Businesses see a record only when they requested it or the renter shared it. Partners see aggregate counts, never photos.
  • • Location data is stripped from the previews we generate. Originals are kept exactly as uploaded so they can be verified.
  • • We don't sell data or send anything to a landlord unless you choose to share it.

Security practices

  • • All traffic is encrypted with HTTPS; our hosting and storage providers encrypt data at rest.
  • • Sign-in uses one-time email links or codes, with bot protection on account creation.
  • • Uploads are type-checked and size-limited; rate limits protect public endpoints; errors are monitored with personal data scrubbed.
  • • Payments are handled by Stripe. We never see or store card numbers.
  • • API keys are stored hashed, can be revoked anytime, and webhooks are signed (HMAC-SHA256).

Retention and your rights

  • • Evidence is kept for 24 months after your last change (5 years on Complete Move) unless you delete it.
  • • Download everything we hold about you from your account at any time.
  • • Delete your account with a 7-day grace period you can cancel; files, records, and sign-in are removed.
  • • Abandoned guest scans are deleted after 7 days.

Service providers

  • • Supabase (database and sign-in), Cloudflare (file storage and bot protection), Render and Netlify (hosting).
  • • Stripe (payments), Sentry (error monitoring), Google Workspace/Gmail (email delivery).
  • • DigiCert and FreeTSA (timestamps; they receive only a fingerprint, never files).
  • • Anthropic (Claude), only if you turn on AI suggestions in your account.

What a MoveGuard record does and doesn’t prove

A record proves files haven’t changed since they were sealed and when sealing happened. It can’t prove a photo shows everything, or that a scene wasn’t staged before it was taken. MoveGuard is documentation, not legal advice; courts, mediators, and platforms decide what weight to give it.

Security questions or a report? Use the support form in your account. See also our privacy notice and terms.