Retail Lease Trac Information Security Policy
This Information Security Policy outlines the practices Retail Lease Trac, Inc. (“Retail Lease Trac”, “RLT”, “Company”, “we”, “us”, or “our”) follows to protect the security of the rltrac.com website and the Service. For a description of the data we collect and how it is used, see our Privacy Policy. Please contact us if you have any questions regarding this Policy.
1. Data Classification
As described in our Privacy Policy, Retail Lease Trac processes two categories of data: Business/Public Information (the retail tenant database) and Account Information (name, email, and phone number collected to administer user accounts). Retail Lease Trac does not collect or process sensitive personal data, such as government identification numbers, financial account details, or health information, as part of the Service. The sections below describe how this data is protected.
2. Access Control
-all access to the Service requires a registered, authenticated user account; there is no anonymous or unauthenticated access to platform data;
-two-factor authentication (2FA) is required for all user accounts, enforced via a registered mobile device;
-passwords are stored using industry-standard encryption and are never stored in plain text;
-internal employee access to systems and data is limited to authorized personnel on a need-to-know basis.
3. Personnel Security & Governance
Retail Lease Trac maintains internal practices for staff data handling and system access. Employees are granted access to systems and data based on job responsibility, on a need-to-know basis, and are expected to follow the practices outlined in this Policy when handling Service data. Employee access is subject to periodic review.
4. Data Transmission
All data transmitted between users and the Service is encrypted in transit using industry-standard TLS/HTTPS encryption.
5. Ongoing Review
Retail Lease Trac continually reviews its systems and data handling practices to help ensure the security and reliability of the Service for our users.
6. Business Continuity & Backups
Retail Lease Trac's third-party development and hosting provider maintains backup and infrastructure redundancy measures designed to support the continued availability of the Service. While Retail Lease Trac does not maintain a separate, formal Business Continuity/Disaster Recovery policy document, these measures are in place to help minimize disruption and support recovery of the Service in the event of an outage.
7. Third-Party Email Authorization
Where a client requests that broadcast communications sent through the Service appear to originate from the client’s own email domain, this is configured through standard sender authentication (SPF/DKIM) added to the client’s own DNS records. This is a one-directional authorization mechanism, it does not provide Retail Lease Trac with access to the client’s email systems, internal networks, or other data, and does not constitute a system integration.
8. Application Security
-code changes to the Service undergo review prior to deployment to production;
-the Service is subject to regular vulnerability scanning to identify and address potential security issues;
-development follows established secure coding guidelines aligned with industry best practices;
-changes to the Service are tested prior to being released to production;
-penetration testing is conducted against the Service by Retail Lease Trac’s third-party development team.
9. Incident Reporting
Security concerns or suspected incidents involving the Service can be directed to contacts listed at rltrac.com/contact
10. United States Law
United States law has created specific offenses for unauthorized actions against computer systems and data. We will investigate any such actions with a view to prosecuting and/or taking civil proceedings to recover damages against those responsible.
11. Policy Review
This Policy may be amended by Retail Lease Trac, Inc. at any time for whatever reason without notice. This Policy will be updated on a continuous basis and it is the user’s responsibility to periodically review this document.