Last updated 27 October 2026.
In transit
gaffy.co is served over HTTPS, so data between your browser and Gaffy is encrypted in transit.
Who can read a row
The database uses Supabase row-level security. Landlord data is limited to the signed-in portfolio. A tenant who signs in can see the requests and the documents that were shared with their email, not the rest of the vault.
The admin view shows totals only. Gaffy staff can't see your properties, tenants, documents or messages through it.
Automated checks
Row-level security is tested automatically. On every pull request, and on every push to the main branch, continuous integration starts a database and runs those tests. They check that one landlord cannot read another's properties, documents, requests or files, that an anonymous visitor cannot read them, and that a signed-in tenant can read the request raised with their email and a document shared with them, and not another landlord's records or a document that was not shared.
Files
Document, receipt, inventory and repair-photo storage is private. The app opens a file with a signed link that expires after 10 minutes (600 seconds). It does not hand out a permanent public URL.
Tenant repair links
Each property and unit link uses a random UUID. Submissions and photo uploads on that link are rate limited per link and per IP address. A report can include up to 5 photos, and each photo must be 10 MB or smaller.
AI
AI suggestions do not run. The app has no call to an AI provider, so a repair, a property or a certificate is not sent to one.
Advertising
The Google Ads tag loads only after you accept cookies. Until then it is not requested. See the privacy notice for what we hold and how to ask for a copy or deletion.
Business customers
We'll sign a data processing agreement with business customers on request.
Contact
Gaffy is a trading name of FORTYFOUR8 LTD, company number 17474844. Registered office: 44 Rivington Street, London, England, EC2A 3QP. Security and privacy questions go to contact@gaffy.co.