Security due diligence: a Rent 2 summary

This page is a plain-language security and compliance summary for due diligence. It is not a certificate, not a penetration-test report, and not a promise of formal ISO 27001 or SOC 2 certification. If you need those artefacts, ask for the current pack — do not infer certification from marketing adjectives.

What we optimise for

Rent 2 holds ID numbers, income, banking details, contracts and collection data for finance providers. The product therefore emphasises: tenant isolation, field-level PII encryption, decrypt-at-fetch patterns, audit logging, POPIA operational workflows, signature-verified webhooks, CSP/HSTS, and PII scrubbing in error reporting.

Multi-tenant isolation

Application code scopes reads and writes by tenant. Dealer portals are strictly role-fenced. Record access checks re-validate tenant ownership after load-by-id. Optional Postgres RLS can add depth. Cross-tenant leakage is treated as a top-class defect with automated authz tests in the suite.

Encryption and secrets

Sensitive customer fields use AES-GCM field encryption with blind indexes where search is required. Integration credentials are stored encrypted per tenant. Production auth fails closed without Clerk — no silent mock auth in prod.

Payments and funds

DebiCheck/Pay Now flows are designed so settlement goes to the client’s bank account via their payment provider profile. Rent 2 is not your bank and does not market itself as holding customer loan books as principal.

POPIA operations

DSR queues, consent, breach register hooks, retention sweeps and decision reason codes exist as product surfaces. Automated decisioning is built to support human review pathways. See the public POPIA Manual and Privacy Policy.

Framework alignment (not certification)

Controls are mapped to common themes in ISO/IEC 27001 Annex A, SOC 2 trust criteria and OWASP ASVS/Top 10 style hardening. “Mapped” and “built to” are intentional words. We do not claim formal ISO or SOC attestation on this site.

Integrations and stubs

External systems (NetCash, Firma, CarTrack, bureaux, WhatsApp, optional Seriti) run live when credentials and flags allow; otherwise stubs protect demos and non-production. Optional channels are labeled as such on integrations.

How to proceed

Read security, review legal pages under legal, then contact us for a structured due-diligence session. Bring your questionnaire; we prefer specific control questions over buzzword bingo.