Effective August 14, 2026 · Maren (getmaren.io)
Maren is an early-stage product run by a two-person founding team. This page says plainly what we do to protect your data — and what we don't do yet — so you can make an informed decision before uploading anything.
Maren runs on Railway (application hosting) with a managed Postgres database from Supabase. We don't operate our own servers. Stored data is encrypted at rest by our database provider as part of its managed service.
All traffic is served over HTTPS (TLS). We send HTTP Strict Transport Security so browsers refuse to downgrade, plus standard hardening headers — a content security policy, clickjacking protection, and content-type sniffing protection — on every response.
Sign-in is passwordless: an emailed, expiring link. We never store passwords, so there is no password database to steal.
If you connect a vendor or platform account, the credentials are encrypted at rest by our application (Fernet: AES-128-CBC with HMAC-SHA256), with the key held outside the database. There is no plaintext fallback — without the key, the app refuses to store credentials at all. Disconnecting destroys the encrypted credential.
Production access is limited to the founders. The third-party processors that run the product — Railway (hosting), Supabase (database), Resend (email), Anthropic (AI plan generation) — each receive only what they need, as described in our privacy policy. Everything else about how data is collected, used, retained, exported, and deleted is governed by that policy.
The model needs unit, floorplan, dates, and rent — not residents. We encourage uploads without resident names, and our PMS integration is built to drop resident names and contact details before anything is stored.
We do not hold a SOC 2 or ISO 27001 certification, and we have not yet commissioned a third-party penetration test. We won't claim either until it's real; when that changes, it will say so here.
If you find a security issue, email hello@getmaren.io. It goes straight to the founders, and we'll respond as quickly as we can.