Security and data
Where the data lives, who owns the technology and how it is protected. Last updated: September 18, 2026.
The technology
The Urbania platform (Showroom, Urbania360 and Cam) is developed and operated by Urbania Group LLC, a company organized in the United States. The code is proprietary: it is not a template or a resold third-party product. The development team works from Rosario, Argentina.
Where the data lives
The primary database runs on Supabase on Amazon Web Services, in the São Paulo, Brazil region. The APIs run on Fly.io, also in São Paulo; the Cam APIs run in Virginia, United States. Sites, images and videos are delivered from Cloudflare's global network, with presence in the Middle East, Europe and the Americas.
Every provider that receives personal data, with which data and where, is on the subprocessor list. For clients that need their data to remain in a specific region, we quote a dedicated deployment in that region.
Encryption
All communications travel over HTTPS (TLS). Data is encrypted at rest with AES-256, both the database and the files.
Credentials that clients enter for their integrations (Stripe keys, availability system tokens) are additionally encrypted in the application with AES-256-GCM, using keys that exist only on the server.
Isolation between clients
All clients share the platform, but every request is filtered on the server by organization and project: a client can only read and write its own data. Database credentials never reach the browser, and no table holding client data can be read through public database access (verified table by table).
Access control
Each user has a role (client, real estate agency or agent) that defines what they see and can do. The client panel supports sign-in with passkeys (Face ID, Touch ID or the device key). Urbania staff access a client's data only to provide support.
Platform protection
Traffic goes through Cloudflare, which filters attacks and abusive traffic before it reaches the servers. Forms and the virtual assistant verify that the user is a person (Cloudflare Turnstile), and the APIs limit the number of requests per source.
Backups
The database has an automatic daily backup, with a minimum retention of 7 days. Files (images, renders, floor plans, videos) also have a weekly copy in separate storage.
For clients that need to recover data to an exact moment (with a maximum loss of minutes instead of hours), point-in-time recovery can be enabled as an additional service.
Monitoring
Application errors are recorded in Sentry so they can be detected and fixed. When a session is recorded to diagnose an error, all text and form fields are masked: the recording does not show names, emails or phone numbers. Key actions in the panels are logged.
Artificial intelligence
The virtual assistant uses OpenAI models (or Anthropic, as an alternative) through their API. Under those providers' terms, data sent through the API is not used to train their models.
Integrations
Available today: Meta and Google ad lead forms, Google Tag Manager, Meta Pixel, Stripe payments and availability sync with Isprop. Integration with other CRMs or ERPs is assessed and quoted per project.
Certifications
Urbania does not currently hold its own certification (such as SOC 2 or ISO 27001). The main providers of its infrastructure (Amazon Web Services, Supabase and Cloudflare) have SOC 2 Type II reports.
Documents and contact
Data processing agreement: urbania3d.app/en/legal/dpa. Subprocessor list: urbania3d.app/en/legal/subprocessors. Privacy and security inquiries: [email protected].