Where your clients’ information lives, and who can touch it

Every document, application and message is stored by Supabase on Amazon Web Services in the Canada Central region, in Montréal. It is not stored anywhere else.

Data is encrypted in transit and at rest. A file is never at a public address: every open goes through a private link that lasts an hour and is created only after Foyer has checked who is asking and whether they may see that file.

Every row in the database carries the brokerage it belongs to, and the database enforces that boundary itself. A request from one brokerage cannot return another brokerage’s clients, documents or messages. Inside a brokerage, a team member sees the clients assigned to them or shared with them, and nothing else.

A client’s information belongs to the subscriber who collected it. Foyer does not sell it, does not use it for advertising, does not build profiles from it, and does not give another subscriber or brokerage access to it. This is written into the Terms of Service, not only here.

The agent’s client page and the renter’s account page both show who opened which document, the application or the letter, and when: the agent and their team, the renter, a co-applicant, the recipient of a package link, and any access by Foyer’s own administrator. A renter can see for themselves that their file was not passed around.

Foyer is run by Royal Merit Realty Inc., a real estate brokerage. Its real estate agents are not Foyer staff and have no access to any subscriber’s files. A Royal Merit agent who uses Foyer is a subscriber like any other, inside their own walled account.

Foyer has no customer service department, and its administrator, the founder, sees no client: not a name, not a document, not a message. The database refuses that account every client row, and the file links refuse it every document. The admin console shows each subscriber account, the plan, the billing status and how many clients, team members and how much storage it has, and nothing inside a file.

When a subscriber wants help with a file, they turn on support access for that file, for one, three or seven days. Only then can the administrator open its documents and application. Every open appears in that file’s access log, labelled Foyer platform administrator, where the agent and the renter both see it; the switch turns itself off when the time is up, and the subscriber can turn it off sooner.

The administrator also holds the account with the hosting provider, which can reach the database directly, as with any software. It is used to keep the service running, to respond to incidents and to answer a lawful demand, never to browse files, and no one else holds it.

If Foyer ever adds support staff, they will work through the same switch, their opens will be logged the same way, and this page will say so at least 30 days before.

Once a file is closed, its documents and application answers are deleted after the period the account owner sets, six months unless they choose otherwise, with a warning to the agent two weeks before. A renter can delete their own account, and everything in it, at any time.

Agents can turn on two-step verification, a code from an authenticator app after the password. Sessions end after 15 minutes without activity. A sign in from a new device or address sends an email at once. Sign in attempts are rate limited.