Built to stand up to a board attorney's questions.
Approval before publishing, a tamper-evident audit trail, checks for protected information, and strict separation between associations.
FIG 1
Built to stand up to a board attorney's questions.
Approval before publishing, a tamper-evident audit trail, checks for protected information, and strict separation between associations.
FIG 1
CondoOS records what your association did and when. It doesn't decide whether you meet Florida law. Nothing it produces is a legal opinion or a certification: not the readiness score, not the Compliance Check, not an evidence pack. Your association's attorney decides what the law requires of you.
Readiness score — reflects CondoOS workflow status, not a legal determination. Evidence packs are labeled “System activity record. Not a legal opinion or a certification of compliance.”
Change one entry and the chain shows it.
Every upload, approval, publication, notice, request and permission change is appended to the log. Each entry carries a fingerprint, a SHA-256 hash, of the one before it. Edit history and every later link breaks, and the evidence pack reports where.
FIG 2
Change one entry and the chain shows it.
Every upload, approval, publication, notice, request and permission change is appended to the log. Each entry carries a fingerprint, a SHA-256 hash, of the one before it. Edit history and every later link breaks, and the evidence pack reports where.
FIG 2
Each association is walled off from every other.
Isolation is enforced in the database itself, with Postgres row-level security, and again by server-side checks on every request. A management company can run a hundred associations without their records ever mixing.
-- every request runs as one association
set app.association_id = 'coral-ridge';
select title, posted_at from documents;
create policy association_isolation
on documents
using (association_id =
current_setting(
'app.association_id'));Enforced by Postgres on every query, and checked again by the application on every request.FIG 3
Each association is walled off from every other.
Isolation is enforced in the database itself, with Postgres row-level security, and again by server-side checks on every request. A management company can run a hundred associations without their records ever mixing.
-- every request runs as one association
set app.association_id = 'coral-ridge';
select title, posted_at from documents;
create policy association_isolation
on documents
using (association_id =
current_setting(
'app.association_id'));Enforced by Postgres on every query, and checked again by the application on every request.FIG 3
Multi-factor sign-in for staff and boards.
Required for portfolio admins, community managers, association admins and board members, using an authenticator app.
Enter the 6-digit code from your authenticator app.
FIG 4
Approval before publishing. A gate for protected numbers.
Uploaded is not published. Every document is approved by an authorized person, one or two per your association's setting. Files flagged for Social Security or bank account numbers, or medical or personnel records, can't be approved until a reviewer confirms the redaction. AI helps spot these; a person always decides.
FIG 5
Encrypted in transit and at rest, on AWS.
In production, CondoOS stores data on Amazon Web Services in the United States and accepts encrypted connections only: TLS from your browser, and TLS from our servers to the database and file storage. Data is encrypted at rest with AWS KMS. AI runs on Amazon Bedrock inside AWS. Your association's content is never used to train third-party models, and document text is treated as untrusted input.
Encrypted in transit and at rest, on AWS.
In production, CondoOS stores data on Amazon Web Services in the United States and accepts encrypted connections only: TLS from your browser, and TLS from our servers to the database and file storage. Data is encrypted at rest with AWS KMS. AI runs on Amazon Bedrock inside AWS. Your association's content is never used to train third-party models, and document text is treated as untrusted input.
See how a document moves from upload to owners, and what an evidence pack holds.
See the product tourEvidence packs, and your data stays yours.
One click exports a ZIP. Inside: summary.pdf with the score, rules and exceptions; manifest.json with every record, version, approval, notice and request, each with its SHA-256; a README; and, if you choose, the published files.
- Export every document and the full audit history at any time.
- Labeled for what it is: a record of system activity, not a legal certification.
manifest.json
Chain intact// manifest.json · inside bayfront-towers-evidence-2026-10-09.zip{ "association": "bayfront-towers", "asOf": "2026-10-09T09:42:00-04:00", "auditChain": { "intact": true, "events": 1412, "headHash": "9f3c…a71e", "problems": [] }, "records": [ { "title": "Milestone inspection report, Phase 1", "version": 3, "published": "2026-10-08", "sha256": "5be1…09ac" }, …
FIG 6
On our list.
Honest status. These are planned, not done. We'll update this page as each one completes.
Security questionnaire from your firm?
Send it with your demo request and we'll return it before the call. Or send it to us on its own first.
Security questionnaire from your firm?
Send it with your demo request and we'll return it before the call. Or send it to us on its own first.