Stripe handles every card
Card entry, storage and charging happen inside Stripe. SFC keeps a token, never a card number or CVV.
Trust & Security
Security and data protection in self-storage software
Storage Facility Creator holds your tenants' names, balances, gate codes and signed leases, so this page says exactly what protects them. No certifications we do not have, no vague promises: the controls below are the ones running in the app today.
Found something? Email support@storagefacilitycreator.com or use Report a Bug inside the app.
Roles enforced twice
Owner, Manager, Employee and Viewer roles are checked in the app and again on our servers.
Sign-in you can harden
Verified email and password, with two-factor sign-in by emailed code.
An audit trail nobody can edit
Payments, move-ins, move-outs, Do Not Rent and team changes are logged per facility with who and when.
What we claim, and what we do not
We do not hold SOC 2 or similar third-party certifications and we do not claim them. What we can show is the set of controls below, each of which is live in the product, plus the published Privacy Policy, Subprocessors list and DPA linked at the end of this page. If a buyer checklist asks for something that is not here, the honest answer is that we do not have it yet.
Sign-in and account access
Every sign-in uses a verified email, and you can require a second factor.
- Every account signs in with a verified email address and password, and resets its own password by email.
- Two-factor sign-in is a per-user switch. Turn it on and every sign-in needs a one-time code sent to your email.
- When an account is disabled, any open session ends within about a minute.
Roles and permissions, enforced in the app and in the database
Four roles per facility, checked twice. The screen hides what a role cannot do, and our servers refuse it even if the screen is bypassed.
- Owner, Manager, Employee and Viewer roles are set per facility, so a manager at one site has no access at another unless you give it.
- Permissions are checked on our servers as well as in the app, so a request that skips the screen still hits the same check.
- Only the facility owner can connect Stripe. Only owners and managers delete rental agreements, run overlocks or sell at the counter. Viewers read.
- Unlimited users are included, so nobody has a reason to share a login.
- Change a role or remove access from one screen, and the change is written to the audit trail.
A per-facility audit trail that cannot be edited
When money moves or a tenant's status changes, the record of who did it is written once and stays.
- Payments, move-ins, move-outs, Do Not Rent changes and team changes are written to a per-facility log that cannot be edited, with who did it and when.
- Every overlock and release is recorded on the unit itself.
- Every autopay change is logged with who made it and when.
- SMS opt-outs are visible and can be restored when the tenant asks, with an audit trail of every restore.
- Each signed agreement keeps the signer’s name, email and signing time.
Payments: Stripe holds the cards, you hold the money
SFC never sees or stores a full card number or CVV. Stripe handles card entry, storage and charging, and each facility's payouts go to that facility's own Stripe account.
- Each facility connects its own Stripe account, so tenant card payments pay out straight to you.
- Cards saved on file, counter payments, pay-by-link, the tenant portal and nightly autopay all run through Stripe. SFC stores a payment-method token, not the card.
- Refunds and chargebacks are handled through Stripe and recorded on the tenant’s ledger.
- PCI handling of card data sits with Stripe. Card numbers are typed into Stripe’s own form, never stored by SFC.
Infrastructure and encryption
The app runs on Google Cloud, so hosting, patching and physical security are Google's, and the application controls on this page are ours.
- Hosted on Google Cloud.
- Data in transit is protected with TLS.
- Data at rest is encrypted by Google Cloud’s default encryption.
- Stripe, Twilio and SendGrid handle payments, texting and email. The full list is on our Subprocessors page.
Deleting a facility, cancelling, and leaving
Destructive actions are slow on purpose, and your data is yours on the way out.
- Deleting a facility takes a typed confirmation and, with two-factor on, a fresh emailed code. Nobody deletes a facility by accident.
- Cancel from inside the app in a few clicks. You keep access to the end of the billing period, and nothing is removed on the day you cancel.
- After a facility leaves for good, we delete or anonymize its tenant data within a reasonable time, as set out in our Privacy Policy. Download your payments CSV and print the statements you want to keep before you go, or email support and we will confirm the removal date with you.
Texting and email tenants have opted into
Tenant messaging is consent-based on every send. See our SMS Terms for the full wording tenants agree to.
- Tenant texts go out from a toll-free number that has completed carrier verification for business (A2P) messaging.
- Texting needs a recorded opt-in. STOP, START and HELP are handled automatically.
- Consent is captured when you add a tenant, in bulk for existing tenants and on every online rental.
- Emails and texts you send are added to the tenant’s contact log, so the whole team can see what was said.
If a tenant provides a phone number and opts in, they may receive account-related SMS messages such as payment reminders and important updates. Message frequency varies. Message and data rates may apply. Reply STOP to opt out at any time. Reply HELP for help. Consent is not a condition of purchase.
Shared responsibility and how to reach us
We secure the platform, the hosting and the connections to Stripe, Twilio and SendGrid. You control who gets a login and which role they have, whether two-factor is on, what your gate controller does with the codes SFC keeps, and the lawful use of your tenants' data.
To report a security concern, email support@storagefacilitycreator.com with what you saw and when, or use Report a Bug inside the app. Support is by email; the number on our site receives texts only.
Security questions operators ask
Is Storage Facility Creator SOC 2 certified?
No. We do not hold SOC 2 or any similar third-party certification and we do not claim one. This page lists the controls that are actually in place, and our Privacy Policy, Subprocessors and DPA pages describe how data is handled.
Does SFC store card numbers?
No. Card entry, storage and charging happen inside Stripe, connected per facility to your own Stripe account. SFC keeps a token that lets Stripe charge the saved card; it never holds the card number or CVV.
Who at my facility can see what?
You give each staff member an Owner, Manager, Employee or Viewer role per facility. The role is enforced in the app and in the database rules, and unlimited users are included, so every person can have their own login.
How do I report a security problem?
Email support@storagefacilitycreator.com with what you saw and when, or use Report a Bug inside the app. Support is by email; the number on our site is for texts only.
More answers on the FAQ page.
Legal and privacy transparency
See the full feature list on Features, walk through the screens on the Product Tour, check Pricing or weigh SFC against other options on Compare Options.
Get Started
Run your facility on software you can vouch for
Start the trial, turn on two-factor sign-in, and invite your team with the roles you want.
No onboarding fee. $75 per facility, per month. Built for self-storage operators.