Property Management IT Guide: Tenant Data and Access

Property management IT comes down to four things: protecting the logins to the platform that holds your tenant and owner records, handling applicant and tenant personal information the way California law expects, keeping payment fraud out of email, and running the cameras, door controllers, and Wi-Fi at your properties as the networked computers they are. This guide walks through each area, then gives you a checklist and questions to put to any IT provider.

The Software and Hardware Property Managers Run

Area	Typical products	IT question to settle
Property management platform	AppFolio, Yardi Breeze, Buildium, Rent Manager	Who are the administrators, and does every user have their own login with a second sign-in step?
Tenant and owner portals	Built into the platform	Are payments and documents kept inside the portal and out of email?
Screening and e-signature	Platform tools, DocuSign	Where do applications and reports end up once a decision is made?
Accounting and banking	Platform ledgers, QuickBooks, bank portals	Who can change vendor or owner bank details, and who checks the change?
Email and documents	Microsoft 365 or Google Workspace	Is multi-factor authentication on for everyone, including shared mailboxes?
On-site systems	Cameras, door and gate controllers, intercoms, leasing office and amenity Wi-Fi	Who owns each system’s administrator login, and is it separate from resident and guest Wi-Fi?
Field devices	Phones and tablets for inspections and maintenance	Can a lost device be locked and wiped?

These platforms are hosted by their vendors, so you do not run a server for them. Your side of the arrangement is who can log in, from which devices, and what your staff download from them.

Start with the platform login

Multi-factor authentication (MFA) means a second proof of identity on top of a password, such as a code from an authenticator app. AppFolio’s help pages state that setting up two-factor authentication is required when a property manager account is activated. Whatever platform you use, check three things in its user settings: the second step is on for every user, no two people share a login, and former employees are removed. A quarterly review of the user list takes a few minutes and catches most problems.

What Does California Require for Tenant Data?

A rental application collects a name together with a Social Security number, a driver’s license number, and bank or income details. California law treats that combination with particular care. This section is IT guidance, not legal advice.

Reasonable security, at any size. Civil Code section 1798.81.5 requires a business that owns, licenses, or maintains personal information about a California resident to implement and maintain reasonable security procedures appropriate to the information. The statute does not list specific products. In practice the question after an incident is whether basics such as MFA, encryption, access limits, and patching were in place.

Breach notification. Civil Code section 1798.82 requires a business to notify affected California residents when unencrypted personal information is acquired by an unauthorized person. The current text sets a deadline of 30 calendar days from discovery, with limited exceptions, and requires a sample copy of the notice to go to the Attorney General within 15 calendar days of notifying consumers when more than 500 residents are involved. Encryption matters here: a stolen laptop with an encrypted drive is a very different event from one without.

The CCPA, above a threshold. The California Consumer Privacy Act applies to for-profit businesses that, according to the California Privacy Protection Agency, have gross annual revenue of $26.625 million or more, buy, sell, or share the personal information of 100,000 or more California residents or households, or earn half or more of their revenue from selling or sharing personal information. Many small management companies fall below those lines, while large portfolios may not. For covered businesses, the Attorney General’s CCPA overview notes that consumers can sue after certain data breaches for actual damages or statutory damages of up to $750 per incident. Our CCPA guide explains how to check whether you are covered.

What this means for your systems

• Keep applications, screening reports, and IDs inside the platform. Avoid downloading them to laptops or forwarding them by email.
• Turn on disk encryption for every laptop (BitLocker on Windows, FileVault on Mac).
• Limit who can see full Social Security and bank account numbers in the platform.
• Set a retention period for applicant files, especially declined applications, with your attorney’s input, and delete on schedule. Data you no longer hold cannot be breached.
• Shred paper applications, and clear the scan-to-email history on shared copiers.

Payments: Keep Card and Bank Data Out of Email

The PCI Security Standards Council states that the PCI Data Security Standard applies to all entities that store, process, or transmit cardholder data, regardless of size. The simplest way to keep your obligations small is to let tenants pay through the platform’s portal, so card and bank details go straight to the payment processor and never touch your computers. Do not accept card numbers by email, write them on paper, or type them into a spreadsheet. Our PCI DSS guide covers the self-assessment side.

The larger money risk is business email compromise (BEC), where a criminal takes over or imitates a mailbox and asks you to change where money goes: an owner’s disbursement account, a vendor’s bank details, a refund. The FBI’s 2025 Internet Crime Report recorded 24,768 BEC complaints with about $3.05 billion in reported losses across all industries. The defenses:

1. MFA on every mailbox.
2. SPF, DKIM, and DMARC records on your domain, which help other mail systems reject messages faking your address.
3. A written rule that any bank detail change is confirmed by phone using a number already on file, and approved by a second person.
4. Staff awareness of fake e-signature and maintenance request emails that lead to look-alike login pages.

The business email compromise guide explains how these scams unfold and what to do in the first hour.

Cameras, Door Access, and Wi-Fi at Your Properties

Every camera, recorder, gate controller, and smart lock hub is a small computer on a network. Treat them that way.

• Change default passwords and give each administrator an individual account. Record the logins in a business password manager that the company controls, so the system does not depend on one employee or installer.
• Update firmware on a schedule. Replace devices the manufacturer no longer updates.
• Separate the networks. Building systems, leasing office computers, and resident or guest Wi-Fi should each sit on their own network segment so that a guest device cannot reach a camera recorder. See network segmentation.
• Avoid exposing recorders to the internet through port forwarding. Use the vendor’s cloud service or a secured remote connection.
• Tie access credentials to move-in and move-out. Fobs, gate codes, and app credentials should be issued and revoked as part of the same checklist as keys. Vendor codes should expire.
• Decide on video retention and who may export footage, and write it down.
• Be careful with audio. Penal Code section 632 prohibits recording confidential communications without the consent of all parties. Many cameras ship with microphones enabled, so ask your attorney before leaving audio on, and keep cameras out of places where people expect privacy.

Our security camera guide covers choosing and placing cameras.

The Risks Specific to Property Management

• A phished platform or email login that exposes tenant records or redirects a payment.
• A lost laptop or tablet holding downloaded applications.
• Former staff or vendors whose codes, fobs, or logins still work.
• Camera and access systems left on default passwords or old firmware.
• Ransomware on the office computers that hold locally saved leases, inspection photos, and HOA records. Cloud platforms protect what is in them, not what is on your file share, so keep a separate backup as described in the business data backup guide.

Checklist You Can Copy

1. Every platform user has an individual login with a second sign-in step.
2. The platform user list is reviewed every quarter.
3. MFA is on for every mailbox, including shared ones.
4. SPF, DKIM, and DMARC are published for your domain.
5. Bank detail changes require phone verification using a known number and a second approver.
6. Tenants pay through the portal. No card numbers in email, on paper, or in spreadsheets.
7. Every laptop is encrypted, and phones and tablets can be wiped remotely.
8. Applications and screening reports stay in the platform and are deleted on a written schedule.
9. Cameras, recorders, and door controllers have unique passwords, current firmware, and their own network segment.
10. Fobs, gate codes, and app credentials are revoked at move-out and at staff departure.
11. Locally stored files are backed up off site, and a restore has been tested.
12. A short incident plan names who to contact at the platform vendor, the bank, your insurer, and your attorney.

Questions to Ask Any IT Provider

• How will you secure our platform and email logins, and how would we learn that one was compromised?
• How do you separate building systems from office computers and resident Wi-Fi?
• Will you document administrator logins for cameras and access control so that we hold them?
• How do you handle devices used by on-site and maintenance staff?
• What is backed up outside our property management platform, and how is a restore tested?
• What is your process when an employee or vendor relationship ends?

When You Do Not Need Much

An owner managing a handful of units through a cloud platform can cover most of this with MFA, a password manager, an encrypted laptop, a backup, and the bank-change rule. The fuller structure pays for itself once you have staff, a leasing office, or building systems at several properties.

Common Questions

Is tenant data safe because our platform is in the cloud?

The vendor secures its data centers and software. You remain responsible for who can log in, how strong those logins are, which devices are used, and anything your staff download or email out of the platform. Most incidents at small companies start with a stolen password, which is on your side of that line.

Does the CCPA apply to a small property management company?

Only if you meet one of its thresholds, such as $26.625 million in gross annual revenue or handling the personal information of 100,000 or more California residents or households. Even below those lines, Civil Code section 1798.81.5 still requires reasonable security for personal information, and the breach notification law still applies.

Can our cameras record audio?

Treat audio with caution. Penal Code section 632 prohibits recording confidential communications without the consent of everyone involved. Because many cameras record sound by default, check the setting on each one and get legal advice before leaving it on.

Who should hold the administrator login for cameras and gates?

The management company or property owner should, in a password manager the company controls. Installers and IT providers can have their own separate administrator accounts. That way a change of vendor or employee does not lock you out of your own systems.

How Coastal Growth Co. Can Help

We can review platform and email security, set up device encryption and management, and sort out the networks behind cameras, door access, and property Wi-Fi. Work is on site or remote, as a one-time project or ongoing support, with scope and price agreed before any paid work. See networks, security and cameras and managed IT, then describe your portfolio on the contact page.