Practical safeguards for accountable agency work.

Users authenticate through the Devv identity service. Access is tied to agency membership and role, with principal, administrator, branch manager, agent, and observer contexts used to limit what a person can view or manage. Sensitive workflows re-check authority on the server; a visible button is not treated as permission.

PropOS records carry an agency context and database access policies are used to enforce tenant boundaries. Server-side operations resolve agency, branch, ownership, and assignment context before changing data. Private document and inspection-photo access uses controlled application flows and time-limited signed links where implemented.

No design can eliminate every risk. We test and review these boundaries as the product evolves and treat any suspected cross-agency exposure as a security incident.

• Encrypted HTTPS connections for production traffic.
• Managed authentication, database, and storage infrastructure.
• Input validation and server-side authorization for privileged business changes.
• Restricted administrative credentials kept outside browser-delivered code.
• Recorded operational or security-sensitive actions where the relevant workflow supports audit logging.
• Dependency, code, and deployment checks proportionate to the product's current stage.

Agencies must use unique accounts, protect devices and credentials, remove access promptly when staff leave, assign the least privilege reasonably needed, review membership and roles, and avoid uploading unnecessary sensitive information. Users must not share accounts or try to bypass security controls. Devv cannot protect information copied outside PropOS or exposed through an agency's compromised device, mailbox, or credentials.

Report suspected unauthorized access, disclosure, account compromise, or a security weakness to Support@teamthink.co.za. Include the affected page or feature, time observed, and enough detail to reproduce the issue, but do not include passwords, private keys, unnecessary personal information, or data taken from another agency.

We investigate credible reports, take reasonable containment and remediation steps, and cooperate with affected responsible parties on legally required notifications. Please do not disrupt the service, access data that is not yours, or publicly disclose an unresolved issue before giving us a reasonable opportunity to investigate.

PropOS is not currently represented as ISO 27001-certified, SOC 2-certified, PCI DSS-certified, or independently penetration-tested unless Devv provides a separate current written statement. Features, suppliers, and controls change over time, and no internet service can promise absolute security or uninterrupted availability. Security questions may be sent toSupport@teamthink.co.za. Last updated: 13 August 2026.