Your data, and the means to prove it
Condominium software holds other people's money, their accounts and their identity documents. Here is exactly what we do to protect them — and what we do not yet do.
The guarantees described here are functional and verifiable. Technical detail is provided in a dossier on request, under a confidentiality agreement.
Two hosting options, one standard
The choice is yours, and it is not final: the same application, the same database, the same code.
With us, on your dedicated space
We operate the platform and you receive a subdomain reserved for your firm. Updates, monitoring and operations are our responsibility.
With you, on your infrastructure
On signature of the annual contract, we deploy the solution on your servers. Your data then passes through no machine we operate.
In both cases, the module carrying our commercial website is absent from the installation: it is not disabled, it is not installed. The corresponding tables do not exist.
Two barriers, not one
Most multi-client software filters data in application code. One forgotten query and the filter is bypassed. We added a second barrier, beneath the code.
The application filter, deny by default
Thirty models carry isolation automatically. With no active scope, a query does not return an empty list: it fails. An oversight is loud, never silent.
A second barrier inside the database engine
Thirty-four data sets carry a rule enforced by the database itself, on reads and on writes. It applies to the most privileged technical accounts too.
The condominium, not the firm
Isolation stops at the condominium. A manager who loses a mandate loses access to that property, and nothing else changes.
Verified against a real database
Nine dedicated tests, one of which queries the database directly to deliberately bypass the application filter: the database refuses. Our integration pipeline fails if the application account holds privileges that would neutralise this protection.
What no one can alter any more
Annex 2 of decree no. 2.23.700 requires accounting records to be tamper-proof. We did not treat that as a checkbox.
Eight tables refuse any change
Accounting entries and lines, payments and allocations, calls for funds and contributions, payroll, audit log. Any attempt to alter or delete is rejected by the database, including from outside the application.
A cryptographic chain
Each entry carries a cryptographic fingerprint covering its content, its lines and the fingerprint of the preceding entry. Removing or altering an entry breaks the chain, and the break shows.
A closing that verifies before sealing
Closing a financial year re-checks the entire chain — linkage and content — before freezing the closing digest. Sealing a year over a broken chain is not possible.
Who may do what, and until when
A permission never exists in the abstract: always over a scope, and often for a limited time.
Twelve roles, thirty-nine permissions
The mapping is declared explicitly, with no implicit inheritance. No "role" column on accounts: assignments live in their own table, with their history.
Four levels of scope
Instance, firm, condominium, unit. A chartered accountant sees the accounts opened to them, not the portfolio.
Access that expires, withdrawal that leaves a trace
Expiry is mandatory for chartered accountants, developers and administrators. A withdrawal revokes, it does not delete: who had access to what remains readable.
Two-factor authentication enforced on sensitive roles
Administration, firm management, property management and accounting cannot opt out. Hardware passkeys are supported, and passwords are checked against known public breaches.
A log that cannot be rewritten
Twenty-one record types are logged automatically, with values before and after.
Immutable at database level
The log is protected by the same mechanism as accounting entries. It does not even have a modification date: the concept does not exist.
Written immediately, never deferred
Recording is synchronous. An entry lost in a queue would carry no weight before a general meeting.
Secrets never enter it
Fifteen fields are systematically redacted — passwords, bank details, card numbers. The key stays visible, the value is replaced.
The author outlives the account
The author's label is frozen at the time of the action. Deleting an account does not erase who did what.
An altered file is never served
Documents are not merely files dropped in a folder.
Outside the web root
Storage is private: no address leads directly to a file. Every read passes through a permission and scope check.
Digest recomputed on every read
The digital fingerprint recorded on upload is recomputed on every download. If it no longer matches, the file is not served and the error is explicit.
Verifiable by a third party, without an account
A seal printed on documents lets a banker, a notary or a buyer check a document's authenticity without going through the syndic.
How we check it
298
automated tests
34
tables isolated by the database
8
tables made immutable
Every release goes through a pipeline that refuses to publish if any of these checks fails: secret scanning across the full repository history, static security analysis with blocking in-house rules, known-vulnerability checks on dependencies, and architecture tests preventing one module from calling another directly.
The security dossier, on request
A public page is not the right place to describe in detail the architecture of a system that holds condominium funds. What matters to your decision, however, must reach you — and it will, in writing.
A security questionnaire, completed and signed
If your IT department has its own framework, we complete it. If it does not, we provide ours.
The real state of things, including what is missing
The dossier lists what the product does not yet do, with a date where one exists. A flaw found after signature costs more than one disclosed before.
A technical discussion, with no sales intermediary
Your teams talk directly to ours. Precise questions receive precise answers.
Under a confidentiality agreement
The dossier commits MNT to its content. It is not public, and that is the condition for it to be complete.
Ask for it before you commit, not after. We would rather answer twenty hard questions during evaluation than one after go-live.
A precise question on a precise point?
We are glad to answer in technical detail, including before your IT department or your chartered accountant.