How we protect your information.

The owner portal is invitation-only. Public sign-ups are disabled — accounts are created by CK Johnson Management for the people who need access.

Sign-in uses email and password over an encrypted (HTTPS) connection. Passwords are checked against a database of known leaked passwords; passwords known to be compromised are rejected at sign-up and on change.

What you can see and do in the portal is controlled by your role. Administrative actions (managing leads, agreements, payments, and signed documents) are restricted to admin users. Role checks run on the server, not in the browser.

Application data is stored in a managed Postgres database with row-level security enabled. Access to each table is governed by policies that scope reads and writes to the appropriate role.

Backend secrets (API keys, service credentials) are kept in a server-side secrets store and are never shipped to the browser.

Signed management agreements and related PDFs are kept in a private file bucket. Access is restricted to admin users; files are not exposed through public URLs. Owners receive copies through their normal channel (email or the portal) when an agreement is finalized.

All traffic to ckjohnsoncapital.com and the portal is served over HTTPS. Payment processing is handled by Stripe — card details are entered directly into Stripe's hosted fields and never touch our servers.

Transactional email (lead confirmations, onboarding links, receipts, agreement notifications) is sent from our own systems with unsubscribe and suppression handling for non-essential mail. We do not sell or share contact information with third parties for marketing.