Data security
A lease isn't a piece of paper left lying on a desk
It holds names, ID numbers, addresses and signatures — yours and your tenant's. So you won't find it lying around on the machines we run on either.
- Database in the EU (Amsterdam)
- We never see your card number
- Processing agreement included
Locked and encrypted contracts
The text of the lease, uploaded documents and signatures are all encrypted. We don't keep the key in the same place, so walking off with the lock gets you nowhere.
Every document has its own lock
It isn't one vault for everything. Every file — lease, amendment, protocol, signed PDF — gets its own key.
You know who opened a document
We record every download of a sensitive document: who, what and when. Only the owner can reach it — a tenant sees only what you share with them. Automated tests keep it that way.
Nobody tracks you inside the app
Marketing cookies run only on this website, and only with your consent. They never reach the signed-in app where your leases and tenants live.
A lease’s journey
What happens to a lease in Najato
- 1
Upload or creation
You create the lease from a template or upload your own. From the first moment it is treated as a sensitive document.
- 2
Encryption with its own key
Every file gets its own encryption key, which is not stored in the same place as the data.
- 3
Stored in the EU
The database runs in the EU (Amsterdam). A data processing agreement is part of the service.
- 4
Access only for authorised people
Only the owner can open the document. A tenant sees only what you share with them in the portal.
- 5
Every download logged
We log every download of a sensitive document: who, what and when. Automated tests guard the access rules.
Security FAQ
Who can access my leases?
Only the owner. A tenant only to the documents you share with them yourself.
Where is the data stored?
The database runs in the EU, in Amsterdam.
Do you store card numbers?
No. Card numbers never reach us; subscription payments are processed by Stripe.
Do you track me in the app?
No. Marketing cookies run only on the website and only with your consent. Tracking never reaches the logged-in app.
Do I need a data processing agreement?
The data processing agreement is part of the service; you don’t need to arrange it separately.