Why facility data is a target
A facility management platform holds a treasure trove of sensitive data: who lives where, when they are home, who visits them, how much they pay, and what security codes open which doors. In the wrong hands, this data enables stalking, burglary, fraud, and identity theft. Security is not a feature — it is a foundational requirement.
Encryption at every layer
Haag applies encryption at three levels:
- At rest — all data stored in the database is encrypted using AES-256. Even if the database is compromised, the data is unreadable without the encryption key.
- In transit — all communication between the mobile apps, the web dashboard, and the backend uses TLS 1.3. No data travels over the network in plaintext.
- On device — the mobile apps use hardware-level encryption (iOS Keychain, Android Keystore) to store authentication tokens and cached data. Even if a device is stolen and jailbroken, the local database remains inaccessible without the enterprise-level decryption key managed via your SSO provider.
Authentication and access control
Every user authenticates through Enterprise SSO or biometric security protocols (fingerprint, face recognition). Passwords are never stored on the device. The system supports role-based access control (RBAC) — a resident can only see their own unit's data, a security guard can only see visitor logs, and a facility manager can see everything within their assigned property.
Granular permissions
Within a property, permissions can be scoped further. A junior manager might have access to service requests and billing but not to personnel records. A security supervisor might see visitor logs across all buildings but not financial data. The permission system is hierarchical and configurable per role.
Data residency and compliance
All Haag data for Nigerian customers is stored in data centres that comply with the Nigeria Data Protection Regulation (NDPR). Data does not leave the country's borders without explicit customer consent. The platform maintains audit logs of every data access — who viewed what record, when, and from which IP address.
Visitor data privacy
Visitor logs are particularly sensitive. The system restricts access to visitor data to authorised security personnel only. Residents can see who visited their own unit, but cannot see visitor logs for other units. Visitor records are automatically purged after a configurable retention period (90 days by default), ensuring the system does not become a permanent surveillance database.
Incident response
In the event of a security incident, Haag has a defined response protocol: detection within 24 hours, containment within 4 hours of detection, and customer notification within 72 hours of confirmation. All incidents are documented and reviewed quarterly to improve the security posture.
The bottom line
Security is not a product you buy. It is a discipline you practice — every line of code, every deployment, every access decision. Haag treats facility data with the same rigour that a bank treats financial data.
