Security you don't see

A system holding a building's contracts, rents and access rights is a system that needs to be properly locked down. Doory uses cookie-only authentication without tokens in the browser, rate limiting, and a session overview in which you can revoke active sessions.

Why this is a conversation you want to be able to have

Most operators aren't IT specialists, and yet the question comes up: how secure is this. From an owner, from a large tenant with its own security policy, or from your own IT partner. Then you want to be able to give a concrete answer and not a general text about security.

What the three points mean

Cookie-only authentication. Your login session is held in a cookie that scripts in the browser can't read, and no tokens are stored in the browser. That makes it harder for malicious scripts or browser extensions to take over a session. It's a choice you never notice as a user, and that is exactly why it's a good one.

Rate limiting. The number of attempts on login and on the public endpoints is limited. That makes automated attempts to guess passwords or overload public pages impractical.

Session overview with revocation. You see which sessions are active and can revoke them. With a lost laptop or an employee leaving, that is a single action, and it is recorded in the audit log.

Where this comes together with the rest

Security in a building isn't only digital. Roles and permissions determine who sees which data, the access module determines who gets through which door, and the audit log shows what happened. Those three together are what a large tenant means when they ask about your policy.

What's needed on your side

Strong passwords, a clear agreement that accounts aren't shared, and actually revoking the accounts of people who leave. That last one is the most common weak spot in any building, and it's the cheapest to fix.