Where it lives, who can reach it, what the law calls each of us, and a table of the things we have not done yet. We would rather you read this page before you trust us than after.
One button exports every book, document and photograph, on any day, whether you are paying or not.
Who we are
Somebody deciding whether to put their whole business in here is entitled to know whose business it is. It is at the foot of every page too, in the smallest type on the site; this is the same five facts where they are actually read.
Legal: legal@premises.ph · Privacy: privacy@premises.ph · Security: legal@premises.ph, and security.txt
If it goes wrong
If your data is exposed, or we believe it may have been, we will tell you within 72 hours of knowing — by email to every administrator on the workspace, and on this page.
We will say what happened, what was reached, what we have done, and what you should do. We will say it before we know everything, and we will keep saying it as we learn more. We would rather be early and incomplete than late and tidy.
Seventy-two hours is what the Philippine Data Privacy Act requires of a controller. It is written here, in advance, so that it is ours as well as the law’s.
The certificate
Every page of premises.ph is served over an encrypted connection, on a certificate issued by GoDaddy. Your browser checks that certificate on every single request — the padlock in your address bar is that check, made by the browser itself and not by us.
Read from the live connection and recorded here on 29 August 2026. This page is static, so these four lines are a RECORD rather than a live reading — the live checks are the padlock in your address bar and the issuer’s own seal beside this, which draws its own date every time it loads.
Drawn by GoDaddy, from GoDaddy, in your browser. This is the only page of premises.ph their script runs on.
One thing worth saying plainly: a certificate is a statement about the CONNECTION between your browser and this site. It is not a rating of the business behind it, and we would rather say so than let a badge imply more than it means. What we do with your data once it arrives is the rest of this page.
Where it lives
A backup nobody has ever restored is a folder, not a backup.
Your estate is its own file, never a shared table with other people’s tenants in it and a column saying which is which.
Uploads are encrypted at rest. Government IDs are masked to the last four everywhere they appear, and never printed into a paper that circulates.
The snapshot is compressed, carried off the machine, then opened again and its rows counted against the source. A drill, not a promise.
Every book, document and photograph on one button, any day, paying or not. Leaving is a feature, and the export is how we keep ourselves honest.
The Data Privacy Act, in plain words
Republic Act 10173 gives each of us a job. These are yours, and these are ours.
The plain-English version for landlords is in the help centre: what the Data Privacy Act asks of you.
What is not done yet
Anybody can list what they have built. This is the same list with the gaps left in, because the gaps are the part you cannot check for yourself.
| What | In our own words | State |
|---|---|---|
| Two-factor on every role | One-time codes on any account you choose, and the recovery codes are shown once. | Done |
| A nightly backup that is opened and counted | Not just written — restored to a scratch machine and its rows counted against the source. | Done |
| Uploads sealed at rest, IDs masked | Files encrypted where they sit; government ID numbers never printed into circulated papers. | Done |
| Lockout and rate limits on every door | And a throttle that is invisible from outside, because a visible one teaches a robot to pace itself. | Done |
| An audit trail you can read yourself | Every money action, every sign-in, every refusal — month by month, and exportable. | Done |
| An outside penetration test | Nobody independent has attacked this yet. We will say so here until somebody has. | Not started |
| SOC 2 or ISO 27001 | We are too new to have paid for either, and a badge we bought is not a fact about your data. | Not started |
Every row is true on the day you read it. When one changes, it changes here first — and a row that has gone stale is a lie with a date on it, so this table is walked before every release.
Six months with everything switched on, no card taken — and the export button works on the way out too.
Monday to Saturday, 8am – 7pm Philippine time.
Write whenever suits you — a person answers, in your hours.