Security

Information security policy.

Last updated 31 August 2026.

What this covers

This policy applies to the systems The Hawley Team runs to serve its clients: our website at teamhawley.com, our client relationship manager, and the individual property apps we build for sellers and buyers. It applies to everyone who works on the team, whether they sit in the Fort Myers office or work remotely.

The Hawley Team is operated by JCS Hawley Corp, a Florida corporation, and that company is responsible for the systems and the practices set out below. The team works within KW Florida Living, a Keller Williams market center, and each Keller Williams office is independently owned and operated.

The information we hold

Names, postal addresses, phone numbers, email addresses, notes from conversations, appointment history, and the property details a client shares with us while buying or selling. Where a client has consented, we also keep recordings and transcripts of calls so an agent can write accurate notes afterwards.

We do not store payment card numbers, Social Security numbers, driving licence numbers, or bank account details on our systems. When money moves, it moves through the title company and the brokerage, not through us.

Where it lives

• Client records sit in a managed PostgreSQL database hosted by Supabase on Amazon Web Services infrastructure in the United States, encrypted at rest by the provider.
• Our applications are hosted by Netlify. Every page and every request is served over TLS. There is no unencrypted route in.
• Nothing client-identifying is kept on personal laptops or phones as the working copy. Team members reach the same central system rather than holding their own export of it.

Who can reach it

Access runs through a single sign-on account on the Hawley Team Hub. There is no second door. An account is created by an administrator, never by self-registration, and it is created only for a member of the team or a contractor working under our direction.

Each account carries a role, and the role decides what that person can do. An agent works their own contacts. A transaction coordinator can send email and text but cannot export, cannot make bulk changes, and cannot see administrative settings. An assistant can import and export but nothing else that is restricted. Administrator rights are held by the broker associate who owns the business.

Roles are checked on the server for every request, and they are read live rather than from the sign-in token. Removing somebody's access takes effect on their next click, not whenever their session happens to lapse.

How accounts are protected

• Passwords are never stored. We keep a PBKDF2-SHA256 derivation with a per-user random salt at 150,000 iterations, so the stored value cannot be reversed into the password that made it.
• Sessions are issued as cryptographically signed tokens with an expiry, verified on the server using a constant-time comparison on every request.
• Password reset links expire after thirty minutes and are bound to the current password, so a link stops working the moment it is used or the password changes by any other route.
• Changes to accounts and roles are written to an audit log that records what changed, who changed it, and when.

Keys and credentials

Database keys, mail credentials and third-party API keys live in server environment variables. They are never published in page source, never sent to a browser, and never committed alongside application code. A browser can only ask our own server for data, and the server decides what that particular person is allowed to see. The database is not reachable directly from the public internet by any account we issue.

Working with other services

We integrate with services that our clients and our brokerage already rely on: Google for email and calendar, our multiple listing service for property data, our telephone provider for calls and text messages, and our brokerage's own systems. Each connection is authorised by the individual team member through that provider's own consent screen, using the narrowest permission that does the job, and it can be revoked by that team member at any time.

We do not sell client information, and we do not hand it to anybody for their own marketing.

Consent and contact preferences

Calling and texting are gated in software, not left to memory. Numbers are checked against the federal and Florida do-not-call registries, permission to contact carries an expiry date rather than lasting forever, and a contact moved to the bin stops every outbound message, letter and call immediately. Text messages carry opt-out wording, and an opt-out is honoured across the whole system rather than one campaign.

Keeping it and letting it go

Records are kept while the relationship is live and afterwards for as long as Florida real estate law and our brokerage require. A client may ask us what we hold, ask for a correction, or ask to be deleted, and the routes for doing that are set out in our privacy policy.

If something goes wrong

Report a suspected problem to martin@teamhawley.com or call (239) 420-9027. We will confirm receipt, shut off the affected access, work out what was reached, and tell the people whose information was involved along with our brokerage. Where Florida law requires notification, we follow the timetable it sets rather than our own.

If you are a security researcher and you have found a weakness in something we run, please write to the same address. Tell us what you found and how to reproduce it, and give us a reasonable chance to fix it before you publish. We will not pursue anyone who reports in good faith and does not access, alter or keep other people's data.

Review

This policy is reviewed at least once a year, and whenever we add a system that touches client information.