PurposeApplication hosting (compute) + managed PostgreSQL database
DataAll FixGrid application + customer data at rest (encrypted AES-256); rate-limit counters (IP address) in Render Key Value
LocationUnited States
AttestationsSOC 2 Type II
PurposeCDN, WAF, DDoS protection, TLS termination, Turnstile bot protection (incl. Invisible mode on login/signup), R2 object storage
DataAll inbound traffic; Turnstile technical signals (e.g. IP, TLS fingerprint, User-Agent, sitekey/origin) per Cloudflare; stored files (photos, documents, reports) in R2
LocationGlobal edge (US configuration)
AttestationsSOC 2 Type II, ISO 27001:2022
PurposeSubscription billing + payment processing
DataPayment/card data (held entirely by Stripe — never stored by FixGrid); subscription metadata
LocationUnited States / global
AttestationsPCI DSS Level 1, SOC 1/2
PurposeTransactional email delivery (invites, notifications, password resets)
DataRecipient email address + message content
LocationUnited States
AttestationsSOC 2 Type II, GDPR, EU-US Data Privacy Framework
PurposeAI features: Grid Zenith and NSPIRE narratives; Report a Problem (reading a resident’s description and photos, and the technician brief built from them); move-out evidence review; equipment nameplate scan; NSPIRE inspection report reading. Grid Zenith health scores are calculated by FixGrid’s own rules, not by AI.
DataNarratives: aggregated property and portfolio metrics, plus property details (name, city, state, unit count, asset class and any planned refinance or sale), the company name, and the text of flagged findings and data gaps. Resident names and contact details are not sent. Other AI features: the text, photos or PDF a user submits (a resident’s problem description and photos, move-out photos, a nameplate photo, a HUD inspection report PDF), which can include names, faces or unit details. No payment data. Per Anthropic's commercial API terms, inputs/outputs are not used to train models.
LocationUnited States
AttestationsSOC 2 Type II, ISO 27001:2022, ISO 42001:2023
Address lookup services
DataThe property’s street address, or the ZIP code entered. No resident or user data.
LocationUS Census Bureau: United States. Nominatim and Zippopotam.us: public internet services
AttestationsPublic lookup services; no customer agreement
Browser push services
PurposeDelivering lock-screen notifications to residents and staff who turn them on
DataAn encrypted notification (short title and message) addressed to the user’s device. The push service cannot read the content; it sees the device’s push address and delivery timing.
ProviderThe device’s browser vendor: Apple, Google (Firebase Cloud Messaging), Mozilla or Microsoft
AttestationsPer each vendor’s trust page