PraxiOS
LandlordOS
HOAOSRuns the firm's account
- Everything a Manager can do
- Firm settings and the firm's PraxiOS subscription
- The full audit log
PraxiOS Security
Is PraxiOS secure for client
tax documents?
PraxiOS keeps each firm's data separate, limits billing and client-portal controls to Managers and Admins, and gives clients hashed portal links that expire in 1 to 30 days instead of passwords. Sign-ins are protected with salted password hashes, strict cookies, forgery protection and rate limits, and key portal and checklist actions are written to an audit log.
Example PraxiOS client portal link for Delgado Properties: expires 14 days after creation, single-use, stored as a salted hash, and revocable by Managers and Admins.
Key facts
- Data isolation
- Every record belongs to one firm, and PraxiOS filters every query by the signed-in user's firm
- Roles
- Admin, Manager and Staff; billing, reports and portal links are Manager/Admin only
- Client access
- No client passwords: a link expiring in 1–30 days, optionally single-use, stored only as a salted hash
- Sign-in
- Salted PBKDF2 password hashes; Secure, HttpOnly, SameSite=Strict cookies; 10 login attempts per 5 minutes
- Audit
- Portal, upload, checklist and reminder events are logged; every record has created and updated timestamps
- Certifications
- None claimed. PraxiOS doesn't hold SOC 2 or similar certifications today
Data isolation
How does PraxiOS keep one firm's data away from another's?
Every client, document, invoice and work item in PraxiOS is stamped with the firm it belongs to, and every query is filtered by that firm. PraxiOS works out your firm on the server from the signed-in user, not from anything in the page or the URL, so changing an ID in the address bar can't reach another firm's records.
- Firm scope is resolved server-side from the signed-in account
- Records are looked up by ID and firm, so another firm's ID returns “not found”
- The client portal checks that every file and checklist item belongs to the same client and firm as the link
- Portal session cookies are bound to one client and one firm
Access
Who can see a client's documents?
Signed-in members of your firm can see your firm's clients and their documents, and the client can see their own documents through their portal link. Nobody outside your firm can. Within the firm, PraxiOS uses three roles to decide who can change sensitive settings and see the money.
Billing, reports and client access
- Invoices, payments, budgets and every report
- Generates and revokes client portal links
- Adds users and manages teams
- Reviews recent audit events in reports
Does the client work
- Clients, work items, to-dos and comments
- Uploads and downloads client documents
- No access to billing, reports or portal links
Teams group people for assignments, and a team's page is visible only to its members, Managers and Admins. Teams don't currently hide clients from other staff in the same firm.
Client portal
How are client portal links protected?
A PraxiOS portal link carries a long random token, and PraxiOS stores only a salted hash of it (PBKDF2 with SHA-256 and 100,000 iterations), so the link can't be read back out of the database. The full link is shown once, when a Manager or Admin creates it.
- Each link expires after 1 to 30 days; the default is 14
- Single-use links are revoked automatically the first time they're opened
- After a link is opened, a signed session cookie (HttpOnly, SameSite=Strict) keeps that client in for up to 4 hours
- Creating a new link replaces the old one; revoking switches portal access off
- Uploads are limited to PDF, JPG, JPEG, PNG, GIF and TIFF, up to 50 MB each, and 20 uploads per 5 minutes
Sign-in & web protections
How does PraxiOS protect staff sign-ins?
PraxiOS stores passwords only as salted PBKDF2 hashes, keeps sessions in cookies scripts can't read, and rate-limits the endpoints attackers target. Every form is protected against cross-site request forgery.
Salted, slow hashes
PBKDF2 with SHA-256, 100,000 iterations and a random salt per password. Reset links expire after 2 hours, and the reset form doesn't reveal whether an email has an account.
Secure, HttpOnly, SameSite=Strict
Session cookies are sent only over HTTPS, can't be read by page scripts, and aren't sent on requests started by other sites.
Throttled where it matters
Login: 10 attempts per 5 minutes. Forgot password: 5 per 15 minutes. Sign-up: 5 per hour. Portal uploads: 20 per 5 minutes.
Forgery and framing protection
Anti-forgery tokens are validated on every form post. HTTPS is enforced with HSTS, and responses carry a content security policy and anti-framing and no-sniff headers.
PraxiOS keeps its cookie-signing keys on disk rather than in memory, so restarts and deployments don't sign everyone out or break a client's portal session part-way through.
Audit
What does PraxiOS log?
PraxiOS writes an audit event, with who, what, when and which record, for the actions that matter most around client access and documents. Managers and Admins can review recent events in the audit report.
Separately, every record in PraxiOS carries a created and a last-updated timestamp that the system sets itself.
- Portal link generated (with expiry and single-use setting), opened, and revoked
- Single-use link opened and automatically revoked
- Documents uploaded through the client portal
- Checklist items added, completed, reopened and deleted
- Reminder emails sent and recurring work generated
Inside PraxiOS
See it in the app.
Real PraxiOS screens, with demo data loaded.
Real PraxiOS screens with demo data; names and figures are made up.
Straight answers
What we don't claim
PraxiOS doesn't hold SOC 2, ISO 27001 or any other security certification today, and we don't list any. This page describes only controls built into the PraxiOS application. It doesn't make claims about hosting regions, backups, uptime or encryption beyond what's described above. PraxiOS doesn't offer two-factor authentication or single sign-on (SSO) yet; SSO is on the Enterprise roadmap. If your firm needs a security questionnaire answered, email us and we'll answer it plainly.
Not claimed
Security certifications
No SOC 2, ISO 27001 or other certification today.
Not yet
Two-factor authentication
Sign-in is email and password, with the protections described above.
Roadmap
Single sign-on (SSO)
On the PraxiOS Enterprise roadmap.
Report a security issuecontact@domodomu.com. Please include the steps to reproduce it, and don't access other people's data while testing.
FAQ
Security questions firms ask
Is PraxiOS SOC 2 certified?+
No. PraxiOS doesn't hold SOC 2 or any other security certification today. DomoDomu describes only the controls built into the PraxiOS application and will answer security questionnaires on request at contact@domodomu.com.
Do clients need a password to use the PraxiOS portal?+
No. PraxiOS sends each client a portal link instead. The link expires after 1 to 30 days, can be set to work only once, is stored only as a salted hash, and can be revoked or replaced by a Manager or Admin at any time.
What happens if a client forwards their PraxiOS portal link?+
Anyone with a PraxiOS portal link can open that client's portal until the link expires, is used (if single-use), or is revoked. For sensitive clients, use a single-use link with a short expiry, and revoke it from the client's page if it may have been shared.
Can staff in PraxiOS see what clients are billed?+
No. In PraxiOS, invoices, payments, budgets and reports are limited to users with the Manager or Admin role. Staff can work on clients and documents without seeing billing.
Does PraxiOS support two-factor authentication or SSO?+
Not yet. PraxiOS sign-in uses an email and password, protected by salted password hashes, strict cookies and a limit of 10 login attempts per 5 minutes. Single sign-on is on the PraxiOS Enterprise roadmap.
Keep exploring PraxiOS
Get started
Ask us the hard security questions.
Book a demo and bring your checklist. We'll show you the portal link settings, roles and audit log in the product.