Encryption in transit and at rest
Data is encrypted moving between the applicant, RentKey and our checking partners, and encrypted again at rest in storage.
Security & compliance
Handled the way a bank would handle it.
Screening only works if applicants trust it and regulators accept it. Here's exactly what happens to an applicant's data — what moves, what's kept, what's thrown away, and which law governs each step — in Canada and the United States.
Data flow
How applicant data moves.
Six steps, start to finish. Each one names what's stored and what's discarded before the next step begins.
1. Invite
The landlord or property manager sends a screening link by email or text, and chooses who pays and which package to run.
Stored: the invite record — who it was sent to, when, and which package. Discarded: nothing yet — no applicant data has been collected.
2. Consent & disclosures
The applicant sees who is asking, exactly what will be checked, and why — and consents before anything runs.
Stored: the consent record and its timestamps, attached to the report. Discarded: nothing — this is the legal record of what was agreed to.
3. Identity on device
On their own phone, the applicant scans a passport, driver's licence or PR/Green card and completes a live facial scan with liveness and tamper checks — about three minutes.
Stored: the match result and a signed verification hash. Discarded: the ID image and every frame of the facial scan, the moment OCR and the match are complete.
4. Checks run against verified identity
Credit, sanctions, law-enforcement and court checks run in parallel, matched to the identity just verified — not a typed name.
Stored: what each source returned, and the time it was searched. Discarded: a SIN or SSN, if one was given — it's used only for that bureau request, not retained.
5. Report assembled & signed
The plain-language report is built from the results above, every source named with its search time, and the finished PDF is given a signed hash.
Stored: the finished report and its signed hash, for seven years. Discarded: nothing new — this step packages what was already kept.
6. Shared by expiring link — retention clock starts
The landlord opens the report through an expiring link, never an email attachment. Every open is logged, and the seven-year retention window starts counting down.
Stored: activity-ledger entries for every open, and the report until the window closes. Discarded: the report and its consent record, automatically, when the window closes.
Data handling
Biometric data retention: what we keep, what we don't.
The retention list is short on purpose — the fewer raw materials we hold, the less there is to protect or to lose.
Kept
Verification result & signed hash
Report PDF, for seven years
Consent record
Activity-ledger entries
Not kept
Facial scan frames
ID document images, after OCR
Biometric templates
SIN / SSN, beyond the bureau request
Controls
The mechanics of keeping it safe.
Role-based access & 2FA
Staff and customer accounts only see what their role requires. Two-factor authentication is available on every account.
Expiring share links
Reports are shared by a link that expires, never as an email attachment sitting in an inbox indefinitely.
Activity ledger
An append-only record of who opened a report and when. Nothing in it can be edited or removed after the fact.
See how the ledger worksOrigin & device forensics
Technical details about where and how a report was accessed are held separately from the report itself, and released only on request — with that release logged too.
Retention & deletion
Reports are kept for seven years. When the window closes, they're deleted from RentKey's systems, and deletion is verified, not assumed.
Compliance map
Where each rule shows up in the product.
Not a policy summary — a line-by-line map from each principle or requirement to what RentKey actually does.
PIPEDA's fair-information principles
| Principle | How RentKey applies it |
|---|---|
| Accountability | RentKey and Crown Stack Systems are responsible for personal information from collection through deletion. |
| Identifying purposes | The applicant is told exactly what will be checked and why, before anything runs. |
| Consent | Nothing is checked until the applicant consents in the flow, and the request is logged. |
| Limiting collection | Only the fields each check needs are collected; no SIN or SSN is required to run the report. |
| Limiting use, disclosure & retention | Data is used only to produce the report, shared only by expiring link, and deleted when the seven-year retention window closes. |
| Accuracy | Identity is matched to government-issued documents and a live scan; credit, sanctions and court results come straight from the source. |
| Safeguards | Encryption in transit and at rest, role-based access, 2FA, and an append-only activity ledger. |
| Openness | This page and the sample report describe exactly what happens to an applicant's information, in plain language. |
| Individual access | Applicants can request what was collected about them from the landlord or property manager who ordered the report. |
| Challenging compliance | Applicants can dispute a finding with RentKey directly, or with the credit bureau for bureau-reported information. |
The US FCRA: who does what
| Requirement | RentKey | Landlord |
|---|---|---|
| Permissible purpose | Confirms the report is requested for a tenancy decision | States and holds the permissible purpose for pulling it |
| Applicant consent | Captures consent in the applicant flow before checks run | Doesn't need to collect separate consent outside the flow |
| Adverse-action notice | Provides the notice text and disclosures inside the report | Sends the notice to the applicant when declining on the report |
| Disputes | Reviews disputed sanctions, court or law-enforcement matches by hand | Directs applicants to the bureau for bureau-reported disputes |
| Data furnishing | Does not furnish applicant data to bureaus or other agencies | Report user, not a data furnisher, under this model |
Human rights & fair housing
A report is only as fair as its use.
RentKey can hand you verifiable facts. What you do with them is still on you — here's how to keep that fair.
What this report leaves out.
No social-media scoring, no protected characteristics, nothing beyond verifiable identity, credit, sanctions, law-enforcement and court records. If it isn't a fact you can lawfully act on, it isn't on the report.
Apply the same standard every time.
Decide what disqualifies an applicant before you screen anyone, and apply it to every application for a unit or building the same way. A report is only fair if it's used consistently.
Document the decision, not just the result.
Keep a note of what a decline was based on and which notice you sent. If a decision is ever questioned, the report and the activity ledger show exactly what was seen and when.
Use the notice, every time.
If a report contributed to declining an applicant, send the adverse-action notice included with it — required under the US FCRA, and good practice everywhere RentKey operates.
Responsible disclosure
Report a vulnerability.
If you've found a security issue in RentKey, tell us before you tell anyone else. Email info@rentkey.ca with "Security" in the subject line — a dedicated security address is coming with general availability.
Include
- What you found, and where
- Steps to reproduce it
- What you think the impact is
We commit to
- Acknowledging your report
- Investigating and fixing confirmed issues
- Crediting you, if you'd like
We don't run a paid bug-bounty program at this stage.
Questions
Straight answers.
Where is data stored?
In Canada and the United States. We state the specific region for your account at onboarding, based on where you operate.
Do you sell data?
Never. RentKey doesn't sell applicant or customer data to anyone, for any purpose.
Can staff read reports?
Only staff whose role requires it, and every access is logged — the same kind of record your own team's opens get in the activity ledger.
What happens in a breach?
We notify affected customers and the relevant regulators as required by law, and tell you plainly what happened and what we're doing about it.
Can I get a data-processing agreement?
Yes, for property managers and platform partners. Request one through contact.
Early access
Stop guessing at the door. Screen the whole picture.
Tell us where you operate and how many units you manage. We'll reply within one business day.
