Public marketing site
Product information, pricing, methodology, security disclosures, and business inquiries. No case files.
CurrentData safeguards
Keep public, payment, and screening data separate.
Reentry Address keeps product information and payment activity separate from the protected SafeAddress workspace used for address-screening records.
Current boundary
This website is not a case-management system.
The public Reentry Address site explains the product and collects business inquiries. It should not receive client names, registry details, victim information, medical records, Social Security numbers, court files, or other case documents.
Payment checkout
Buyer and payment details are handled through the configured payment provider. Screening inputs do not belong in checkout fields.
Separate serviceProtected SafeAddress workspace
Named invited accounts, hashed passwords, secure sessions, organization roles, server-side saved screenings, and audit events.
CurrentCurrent operating model
Security controls follow the person, organization, and record
SafeAddress uses named access and server-side organization checks. The controls below distinguish what exists now from work that remains.
Named invited accounts
Users sign in with individual accounts. Passwords are stored as hashes, and application sessions use protected cookies rather than shared login links.
Role-based permissions
Organization and platform roles are checked server-side so access can be limited and accounts can be deactivated without deleting history.
Organization isolation
Protected records are associated with an organization, and access checks occur before records are returned or changed.
Server-side storage
Accounts, sessions, saved screenings, and workflow records are stored in the application database instead of relying on browser-only storage.
Audit events
Security-relevant and workflow actions can be recorded with the user, organization, action, and time to support review and troubleshooting.
Controls still to mature
SafeAddress does not claim MFA, SOC 2, CJIS, HIPAA, independent penetration testing, or other controls until they are implemented and verified.
Data minimization
Collect less. Retain less. Expose less.
A housing-screening product should not become a second criminal-history database.
Minimum identity data
Use case identifiers or initials where full identity is unnecessary for the task.
Defined retention
Saved screenings are retained for 90 days, restricted-access audit events for 365 days, and resolved data reports for 180 days under the published retention schedule.
Private files
Supporting documents should use private object storage and short-lived download links.
Support access controls
Platform staff access should be time-limited, logged, approved, and restricted to what support requires.
Claims we will not make
Security language has to match what is actually implemented
Trust collapses when a product claims certifications or protections it has not earned.
- No claim of SOC 2 certification until an audit is complete
- No claim of CJIS compliance without the required architecture, agreements, controls, and review
- No claim of HIPAA compliance merely because some users work in health or behavioral-health settings
- No claim of MFA or independent penetration testing until those controls are implemented and verified
- No use of “fully secure” or “enterprise-grade” as a substitute for documented controls
A clearer first step
Bring your security questionnaire early.
Organization access begins with a review of the workflow, data involved, and controls required for the intended use.