Security & data handling

Last updated: July 7, 2026

UFBA handles compliance data for public agencies, so security is a design requirement — not an afterthought. This page summarizes how we approach it for this website and for the UFBA CMS.

This website

• All pages are served over HTTPS (TLS), with HTTP requests redirected.
• No client compliance data is stored on this website. It runs on infrastructure isolated from UFBA’s compliance systems.
• The site is hardened and kept current: administrative file editing is disabled, sign-in attempts are rate-limited, and security updates are applied automatically.

The UFBA CMS

• Strict data isolation between accounts — each agency’s data is segregated and never visible to another account.
• Role-based access control: agency staff, property managers, owners, and tenants each see only what their role permits.
• Encryption in transit on every connection; passkey and multi-factor authentication supported for user sign-in.
• Audit trails on compliance-relevant actions.

Reporting a vulnerability

If you believe you have found a security issue in this website or the UFBA CMS, please report it to info@ufbahc.com with enough detail for us to reproduce it. We appreciate responsible disclosure and will respond promptly.