Controlled, Invitation-Only Access
There is no public sign-up. Every portal account is created by invitation from Tapestry, and access can be suspended or revoked at any time.
Privacy by Operational Design
Client Portal Security & Privacy
The Tapestry Client Portal is an invitation-only private operating environment designed around controlled access, client isolation and operational discretion.
Client Data Isolation
Each client account is separated at the database level. Access rules are enforced by the database itself for every request, not merely by hiding screens, so one client's users cannot read another client's records.
Role & Assignment-Based Permissions
Tapestry personnel are granted access according to role, client assignment, residence assignment and operational need. Personnel who are not assigned to an account do not have routine access to that client's private operational records — including documents, photographs, reports and shared files.
Within your household or office, each member's role determines which sections they can see, for example whether financial records are visible.
Multi-Factor Authentication
Designated client roles with sensitive financial access, including Family Office representatives and accountants, are required to use two-step verification with an authenticator app.
Private Document & Media Storage
Documents and photographs are held in private storage with authenticated access. A file is reachable by a client user only when it has been explicitly shared with that client's account, and files are delivered through short-lived signed links that expire.
Encryption
Portal data is encrypted in transit and at rest using the security controls provided by the underlying cloud infrastructure — TLS 1.2 / 1.3 in transit and AES-256 infrastructure encryption at rest.
Sensitive Property Access Credentials
Gate, alarm, garage and lock codes are maintained separately from ordinary residence notes, masked by default and available only to appropriately authorized users. Every credential reveal is recorded in the security audit history. These codes are not emailed and are not included in reports, exports or notifications.
Administrative / Privileged Access
Limited privileged administrative access is retained for authorized platform administration, security and support functions. Temporary emergency access requires a documented reason, is time-limited and is recorded in the security audit history.
Audit Logging
Staff changes to client records, document signing events, inventory changes, staff assignments, privileged access, access-code reveals, two-step verification changes and role changes are recorded in protected logs.
Photo Privacy
Residence photographs uploaded through supported inspection workflows are processed to remove embedded GPS coordinates and device metadata before storage. Reports do not display exact GPS coordinates.
Financial Information Controls
Financial ledger visibility is limited to designated member roles — such as Principals, Family Office representatives and accountants — and is enforced by the database, not by screen layout.
Travel & Occupancy Information Controls
Travel itineraries and occupancy information are restricted to the client's own authorized members and assigned Tapestry personnel, under the same database-enforced isolation as all other records.
No Advertising or Data Monetization
Tapestry does not sell client information, use client information for advertising, or share client information with data brokers. Information entrusted to Tapestry is processed for the purposes of providing, administering, securing, and supporting our services.
Advertising / Tracking
The authenticated Client Portal contains no third-party advertising or behavioral marketing trackers. Tapestry does not sell client information.
Infrastructure Security
The Tapestry Client Portal is built upon cloud infrastructure provided by technology partners that maintain recognized SOC 2 Type II and ISO 27001 information-security certifications. These certifications apply to the relevant technology providers and infrastructure; they do not represent separate SOC 2 or ISO 27001 certifications issued directly to Tapestry Estate & Lifestyle.
Automatic daily backups are retained for up to 14 days.
Client User Removal
When a member of your household or office should no longer have access, their portal access is revoked and their sign-in no longer reaches your records.
Client Offboarding / Data Export
When an engagement ends, portal access is revoked. On written request, Tapestry will provide copies of your shared documents and remove your account records, subject to any records we are required to retain. Deleted information may persist in backups until those backups expire.
Security Contact
To report a security concern or request account removal, write to stewardship@tapestryestateandlifestyle.com.
Questions
Security FAQ
Is the Tapestry Client Portal secure?
The Portal is invitation-only, isolates each client's records at the database level, encrypts data in transit and at rest, and logs sensitive staff activity.
Who can access my information?
Your authorized members, and Tapestry personnel assigned to your account according to role and operational need.
Can another client see my records?
No. Client separation is enforced by the database itself on every request, not by hiding screens.
Can Tapestry personnel access my records?
Only personnel assigned to your account have routine access. Limited privileged access exists for platform administration, security and support; temporary emergency access requires a documented reason, is time-limited and is logged.
Is multi-factor authentication used?
Yes — designated client roles with sensitive financial access, including Family Office representatives and accountants, are required to use two-step verification with an authenticator app.
Is my information encrypted?
Yes — in transit (TLS 1.2 / 1.3) and at rest (AES-256 infrastructure encryption) through our cloud infrastructure providers.
How are documents protected?
Documents are held in private storage, require authenticated access, are shared explicitly per client account, and are delivered through short-lived expiring links.
How are gate and alarm codes protected?
They are stored separately from ordinary notes, masked by default, revealed only by authorized users, and every reveal is logged.
Does Tapestry sell client data?
No. Tapestry does not sell client information.
Is my information used for advertising?
No. The authenticated Client Portal contains no third-party advertising or behavioral marketing trackers.
Is client information shared with data brokers?
No. Tapestry does not sell client information, use client information for advertising, or share client information with data brokers. Information entrusted to Tapestry is processed for the purposes of providing, administering, securing, and supporting our services.
What security certifications apply?
The Portal runs on cloud infrastructure whose providers maintain SOC 2 Type II and ISO 27001 certifications. These belong to the infrastructure providers; Tapestry itself does not hold SOC 2 or ISO 27001 certification.
What happens when a user is removed?
Their portal access is revoked and their sign-in no longer reaches your records.
What happens to my information if I terminate service?
Access is revoked, and on written request Tapestry provides copies of your shared documents and removes your account records, subject to required retention. Deleted information may persist in backups until they expire.