IT Support for Property Management Companies

Rental applications, credit reports, ID copies, banking details for pre-authorized rent, and maintenance notes about who is home when: a property manager holds a lot of sensitive tenant information. For a private-sector manager in Ontario this is covered by PIPEDA.

Collect what you need, keep it in the property management system rather than inbox attachments, delete applications you did not accept on a schedule (records retention), and restrict who can open credit reports. A breach that creates a real risk of significant harm must be reported to the Privacy Commissioner and tenants notified; the OPC's guidance explains the test.

This page is practical guidance, not legal advice; confirm how the law applies to your organization with counsel.

Two frauds are common. Tenants receive a spoofed email "from management" with new banking details for rent. And accounts payable receives an email from a contractor, apparently genuine, changing where invoices are paid.

For tenants: publish DMARC at enforcement so your domain cannot be spoofed, and tell tenants in the lease and on the portal that you will never change payment details by email. For vendors: confirm any change by phone to a number already on file, with a second approver (payment verification procedure). Multi-factor sign-in on every mailbox stops the account takeover that usually starts it.

Door access control, intercoms, cameras, elevator monitoring and building automation are often installed by different contractors and plugged into whatever network was there. That puts devices with default passwords and old firmware next to the PC that holds tenant files.

Give building systems their own network segment per property, with no route to the office network beyond what a monitoring service needs. Change default passwords, keep an inventory with firmware versions, and give contractors remote access only through a controlled, time-limited route (third-party remote access). Our Microsoft 365 cleanup for a fire protection and security company shows the kind of tidy-up these firms need on the office side.

Superintendents and leasing agents work from site offices, phones and shared tablets. Give each person a named login, manage the devices so a lost phone can be wiped, and remove access the day someone leaves.

Property owners, condominium boards and cyber insurers ask about multi-factor sign-in, backups, segmentation of building systems and incident response. Answer from what is configured, in writing. Before you talk to any provider, test your domain with our email spoofing check and work through the printable IT risk self-check.

If you only do four things this month, do these, in this order. Each is cheap and each closes a gap we see often in this sector.

1. 01

   1.

   Turn on multi-factor sign-in on every mailbox and the property management system.

2. 02

   2.

   Move DMARC to enforcement and add a payment-details warning to leases and the tenant portal.

3. 03

   3.

   Inventory cameras, access control and intercoms at each property and move them to their own segment.

4. 04

   4.

   Delete rental applications past your retention date.