Security & Trust
Last updated: 4 September 2026
We're building Rentowa to run the operations of rental businesses, so security and reliability are core to the product. This page describes the controls currently in place on our marketing site and the practices we're committing to as we roll out the product.
This page is maintained by Rentowa (Alwin Gilles e.K.) to answer common security and privacy questions about Rentowa. It is not an independent certification.
Rentowa is currently a pre-product marketing site. Statements below describe controls active today; controls specific to the future application (customer accounts, tenant data, backups, etc.) will be published here before general availability.
Encryption in transit
All traffic to rentowa.com and its subdomains is served exclusively over HTTPS/TLS. HTTP requests are redirected to HTTPS by our hosting provider and CDN.
Hosting & infrastructure
The website and its backend services run on Lovable Cloud, which is built on Supabase infrastructure operated in the European Union. Databases are managed, patched and backed up by the platform provider.
Application controls
- Row-Level Security (RLS) is enabled on every application table that stores user-submitted data.
- Server-side validation is enforced on all public endpoints (e.g. contact form submissions).
- Transactional email is bound to server-validated records to prevent open-relay abuse.
- Internal database functions run with least-privilege execution rights.
Access & secrets
Administrative access to backend infrastructure is restricted to a small number of authorized operators and protected by strong authentication. Secrets (API keys, database credentials, email provider tokens) are stored in the platform's managed secret store and are never committed to source control or exposed to the browser.
Subprocessors
We rely on the following processors under Art. 28 GDPR:
- Hosting, database & serverless functions: Lovable Cloud (Supabase infrastructure, EU region)
- Transactional email delivery: our outbound email provider (used only for confirmations and notifications)
- DNS, TLS termination & CDN: Cloudflare
A more detailed list will be maintained in our privacy policy. For a signed DPA, contact us at the address below.
Data handling & retention
The only personal data we currently process through this site is what you submit via the contact form (name, email, subject, message). We use it exclusively to reply to your inquiry and retain it only as long as necessary. See the privacy policy for full details, legal bases and your GDPR rights.
Shared responsibility
- Securing the application, infrastructure and platform integrations
- Applying platform-level patches, backups and monitoring
- Restricting production access and rotating credentials
- Publishing changes to this page as our controls evolve
- Protecting their own account credentials once the product is available
- Managing user roles and access within their workspace
- Reviewing data shared through integrations they enable
Reporting a security issue
If you believe you've found a security vulnerability, please email contact@rentowa.com with a description and reproduction steps. We appreciate responsible disclosure and will respond as quickly as we can. Please do not publicly disclose the issue until we've had a chance to investigate.