AppFolio Security Basics

Overview

AppFolio manages property portfolios containing tenant PII (SSNs, bank accounts, lease terms), owner financial data, and maintenance vendor records. A breach exposes rent rolls, payment histories, and personally identifiable tenant information across every managed property. Secure every integration point: API credentials, webhook endpoints, and any pipeline that touches tenant or owner financial records.

Prerequisites

• A verified AppFolio contract stating the permitted endpoint, authentication, webhook, data-retention, and portfolio-scoping requirements for the target environment.
• A secret manager, separate sandbox credentials, and a named security owner for rotations, access review, and incident response.
• A raw-body route configuration for any signed webhook: signature verification must run before JSON parsing, mutation, or logging of the request payload.

Instructions