Security and privacy
In developmentHow we protect estate and resident data
Manorlogic keeps each estate's data separate, limits access by role, checks visitor passes on the server and logs changes to money, passes and gate records. Residents can ask for a copy of their data or for erasure. We do not claim independent certification. This page says what exists and what does not.
Opens an email to our team. Nothing is submitted until you press send.
What exists today
Each estate's data is kept separate
Every record belongs to one estate. The estate comes from your signed-in session, and a request for another estate's record returns "not found". We are still hardening this area, and we do not describe it as guaranteed.
Access is limited by role
Estate admins, managers, residents and guards each see only what the job needs. A guard cannot reach finance, and a resident sees their own household. Every action is checked against the person's role, and a removed person loses access on their next request.
The server decides who gets in
A pass that has expired, been cancelled or been used up is refused by the server, even if a guard's phone shows an old screen.
Changes are logged
Changes to payments, invoices, passes, gate entries, roles and estate settings are logged with who made them. Gate entries are not edited; a correction is a new entry. We do not claim the log is tamper-proof.
Sign-in
Sign-in uses an email address and a password. Accounts are created by invitation from your estate, and there is no public sign-up. Sign-in attempts are rate-limited, sessions expire, and signing out ends a session.
Payments
Card details are entered on Paystack's page and are not stored by Manorlogic. Money is stored in whole kobo. Online payment is built into the product and has not yet been used in a live estate.
Data requests
Built with the Nigeria Data Protection Act in mind: a resident can request a copy of their data, or ask for their personal details to be erased. The manager handles the request. Erasure anonymises the person's details, and invoices and payments are kept so the estate's accounts stay whole. Some edge cases in these workflows are still being closed. Staff can also log a data-breach incident.
Who can see what
| Role | What they can see and do |
|---|---|
| Estate admin and manager | Run the estate: households, billing, gate records, announcements, privacy requests. Admins also edit estate settings and give out elevated roles. |
| Resident | Their own household's invoices, passes, parcels and alerts. A head of household chooses which household members can see invoices and who is alerted. |
| Guard | The gate: passes, entries and exits, parcels, incidents and handovers. No invoices. |
What we store
Account email and a hashed password; name and phone; an optional profile photo; estate roles, households and units; visitor names, phones and plate text on passes; gate events; parcel records and photos; invoices and payments (references, never card numbers); messages, tickets and announcements; push-notification tokens; and a history of changes to the records above. Contractor documents and insurance documents are held where an estate uses those tools.
Who else handles data
We use outside providers for payments (Paystack), text messages, email, phone notifications, error tracking and hosting.
What we do not claim
- Certifications. We do not claim independent certification.
- NDPA compliance. We do not describe Manorlogic as NDPA compliant. That is a legal conclusion for counsel and the regulator.
- Uptime. We make no claim about uptime.
- Backups and disaster recovery. We make no claim about either.
- Where data is held. We make no claim about the country or region where data is stored.
- Two-factor sign-in. Not available.
- Automatic deletion of visitor data. Visitor and vehicle details are not deleted automatically.
Report a security problem
If you think you have found a weakness, email info@caramelcove.com with "Security" in the subject line. Tell us what you saw and where. Please do not test against another estate's data.
This website
This website sets no cookies and uses Cloudflare Web Analytics, a cookieless visit counter, to see which pages are read and how fast they load. Read the privacy policy for what it collects.
Questions about your residents' data?
Book a walkthrough and ask us anything on this page. We will answer plainly, including where the answer is "not yet".
Opens an email to our team. Nothing is submitted until you press send.