LangoHub
Back to LangoHubAll legal documents

Security

Last updated: 13 October 2026

This page describes the technical and organisational measures LangoHub uses to protect personal data. They are required by:

  • section 41 of the Data Protection Act, 2019; and
  • Regulation 32 of the General Regulations.

It is Annex 2 of our Data Processing Agreement.

Infrastructure

  • The app, database, sign-in and file storage are hosted by Lovable Cloud, built on Supabase and running on Amazon Web Services. The region is Oregon, United States.
  • Our hosting providers hold SOC 2 Type II and ISO 27001 certifications.
  • Data is encrypted in transit (HTTPS/TLS) and encrypted at rest by the provider.
  • Backups are made automatically by the provider and overwritten on a rolling basis.

Separation between estates and access control

  • Database separation. Every estate's data is separated at the database level using row-level security. One estate cannot read another estate's records.
  • Role-based access. Each role sees only what it needs:
    • guards see the gate;
    • residents see their own guests and passes;
    • managers see their estate; and
    • sales staff cannot see visitor records.
  • Guard PINs. PINs are stored only as salted hashes.
  • Gate phones. Gate phones must be registered before use, and a manager can revoke a lost device.
  • Our staff. Support access by LangoHub staff is limited to named administrators and recorded in an audit log, including when a staff member views the app as an estate user.

Minimising data

  • ID images. Images from ID scanning are not stored by LangoHub. Only the holder's name and document number are extracted. The AI provider may keep the image for up to 30 days for abuse monitoring, and does not use it for training.
  • No biometrics. LangoHub does not use facial recognition or biometric templates.
  • Photos. Photos are kept in private storage, shown only through short-lived links, and never included in CSV exports (provided only on request).
  • Optional features. Photos, vehicle photos and ID scanning are optional. Each estate switches them on or off.
  • Automatic deletion. Records are deleted automatically according to our Retention Schedule.

Gate devices and offline use

  • What the offline gate keeps. The gate keeps only what it needs to work without data, and syncs it to the server as soon as a connection returns.
  • Sign-in on the gate. Gate sign-in uses the guard PIN, including when offline.
  • App updates. Updates are delivered as signed releases. The web layer updates over the air from our own storage.

People and processes

  • Confidentiality. Everyone with access to personal data is bound by confidentiality.
  • Rules for users. Our Acceptable Use Policy sets the rules for guards, residents and managers.
  • Updates. Dependencies and security updates are applied regularly.
  • Abuse protection. Rate limits protect sign-in and ID scanning from abuse.

Breach response

If we become aware of a personal data breach, we:

  1. contain it and assess the risk to the people affected;
  2. notify the affected estates without delay, and where possible within 48 hours, with the details listed in clause 4.5 of our Data Processing Agreement;
  3. where we are the controller, notify the Data Commissioner within 72 hours;
  4. notify affected people where there is a real risk of harm; and
  5. record the breach and what we learned from it.

Reporting a security issue

Email privacy@langohub.app with details. Please do not access other people's data while testing, and give us reasonable time to fix the issue before you make it public.