Security overview

This is usually the first question, so it is the first answer. The HUD tools — income recertification, NSPIRE, SEMAP, EIV, rent reasonableness, income limits — contain no artificial intelligence of any kind. They are ordinary arithmetic written against the published HUD rules. A household’s income, its composition, and its rent calculation are processed by deterministic code on our own servers and are never transmitted to Anthropic, OpenAI, or any other model provider.

That matters beyond privacy. A calculation performed by a language model cannot be audited, cannot be reproduced exactly, and cannot be defended in a HUD review. Ours can: the same household produces the same numbers every time, and every figure traces back to the rule that produced it.

Honestkey™ does use AI in one place — reading uploaded lease PDFs on the consumer side of the product, which is a separate service from the government tools. If your agency never uploads a lease for scanning, no data of yours reaches a model provider at all.

In the United States. The database and uploaded files sit in Amazon Web Services’ us-east-1 region, managed by Supabase, on PostgreSQL 17. The application runs on Vercel, also in the United States. Nothing is stored or processed outside the country.

Data is encrypted in transit using TLS 1.2 or better, and encrypted at rest using AES-256. That applies to the database, to uploaded documents, and to backups.

Access is enforced by the database, not only by the application. Every table carries row-level security tied to the signed-in account, and agency records are additionally scoped to the organization that owns them. A request that somehow reached the wrong row would be refused by PostgreSQL itself, which means a bug in the application cannot quietly expose another agency’s caseload.

The administrative credential that bypasses those rules exists only on the server. It is never sent to a browser and is not present in any code that runs on your machine.

Access to production by our own staff is limited to the people who need it, and protected by multi-factor authentication.

These are every third party involved in running the service. There are no others.

Vercel, Supabase and Stripe each maintain their own SOC 2 attestations, which they publish. We can point you at the current reports on request.

Your data is yours. You can export it at any time, and you can ask us to delete it — in which case it is removed from the live database, and falls out of backups as those age out on the normal cycle. We do not sell data, we do not share it with advertisers, and we do not use one agency’s data to serve another.

The database is backed up automatically by Supabase on their managed schedule.

Errors are reported to Sentry and reviewed. If a security incident affected your data, we would tell you directly and promptly, with what we know, what we did, and what you need to do — not a notice buried in a status page. Report anything that looks wrong to hello@honestkey.com and it will be looked at the same day.

A reviewer who finds one overstatement on a page like this is right to distrust the rest of it, so here is the honest boundary:

• Honestkey™ does not hold its own SOC 2 attestation. Our infrastructure providers do; we do not, and we will not claim otherwise.
• We are not FedRAMP authorized.
• We have not commissioned an independent penetration test.
• We are a small company. That is the trade: you get the person who wrote the software answering your email, and you do not get an enterprise compliance department.

If your agency requires any of the above before it can buy, tell us and we will say plainly whether we can meet it and by when, rather than leaving you to find out during procurement.

If you are assembling documentation for a purchase, the procurement page has the threshold position, the paperwork we can supply, and what to expect on timing.