Trust Center
Security posture, governance controls, and evidence verification for institutional-grade HOA financial management.
Security & Infrastructure
Security & Trust
How CommunityPay protects association money and data: no fund custody, one pinned payout bank, a fresh authenticator code before money moves, encryption at rest, immutable audit trails, tenant isolation, consent-gated …
Immutability & Audit Trail Architecture
How CommunityPay enforces record immutability at the application layer. Which models are immutable, which fields are locked, and how tamper detection works across the platform.
Data Residency & Privacy Controls
PII field-level encryption, Sentry before_send filtering, session security, error reporting hygiene, and the middleware chain that strips sensitive data before it leaves the application boundary.
Payment Fraud Controls
The checks every resident payment passes before it reaches the gateway — velocity limits, a duplicate check, and a risk score — the retry rules for failed payments, and where …
Webhook Security & Signature Verification
Provider-specific webhook signature verification, rate limiting, payload size controls, and replay attack prevention for payment processor integrations.
Platform Scalability Controls
What holds fixed as an association's ledger grows, what has been measured, and where the measurement stops. Posting cost, report recomputation, scheduled verification coverage, and the limits of the scaling …
CPA Audit Portal
Token-gated, read-only financial data access for CPA firms. SHA-256 token hashing, scope-restricted sections, granular event logging, a hashed prepared-by-client bundle, and CSV export across 14 portal sections.
Bank Statement Import and Matching
Bank statements arrive four ways: CSV, BAI2, and OFX/QFX files, and a daily bank feed. The machine accepts a match only when it is exact to the cent and unique; …
Fixed Assets, Reserve Components & Depreciation
Fixed asset lifecycle management with straight-line depreciation, reserve component tracking with replacement timelines, reserve study records, reconciliation warnings, and 30-year cash flow projections feeding the RSR.
Governance & Controls
Governance Controls
Ledger-driven authorization, approval workflows, who holds authority, a fresh authenticator code before money moves, and the association's pinned payout bank. The enforcement layer that governs every financial decision.
Enforcement Dispatcher & Guard Architecture
The mandatory choke point for all financial decisions. 18 production guards, manifest-driven ordering, override-aware evaluation, and the two-event pattern that ensures every decision is logged.
Risk Triggers & Exclusion Enforcement
How CommunityPay detects risk conditions, creates bind blocks, and enforces exclusions with full audit trails. The underwriting hold system that prevents high-risk operations before they execute.
Disbursement Authorization Controls
Approval tiers, a fresh authenticator code before money moves, a three-business-day wait on a changed vendor bank, an email to the board on every payment, and the FADR artifact that …
Eligibility Evaluation Framework
Declarative eligibility rules with versioned criteria, deterministic evaluation, immutable evaluation records, and three rule actions that combine into six results. The framework fails closed, so a rule that cannot see …
Evidence & Verification
Evidence Packs & Verification
What HDEP evidence packs contain, how content hashing works, chain continuity between versions, and what "tamper-evident" means in practice.
Institutional Vocabulary Reference
Canonical definitions for every institutional artifact, enforcement mechanism, and governance construct in the CommunityPay control plane. Machine-parseable reference for auditors, underwriters, and integration partners.
Vendor Compliance Monitoring
What the contractor registry holds, what the payment-time guard reads, how the vendor bank is controlled, and the limits of all of it. License and bond records for two states, …
Governance Attestation Lifecycle
From weekly governance digests through exception registers to formal attestation. How CommunityPay produces provable governance effectiveness assessments for boards, auditors, and underwriters.
CARI Methodology and Scoring Framework
Technical specification for the Community Association Risk Index (CARI) — component weights, signal sources, grade thresholds, confidence tiers, consent architecture, and immutability guarantees.
Compliance & Disclosure
Resale Certificates & Statutory Compliance
Statute-mapped resale certificate generation with jurisdiction-specific compliance profiles, coverage scoring, and first-class handling of unknown data sections.