How to keep tenant and owner data safe when using AI in property management

This guide is for property management companies in Canada and the US starting to use AI with tenant and owner information. Keeping that information safe comes down to knowing where it goes once it’s in an AI tool, and asking the vendor a clear question at each step. Your company stays responsible for personal information it hands to a vendor, so their answers become part of how you protect your residents and owners.

The easiest way to see the questions is to follow one message through the system.

The message

At 9pm, a resident texts the number on their lease:

Hi, it’s Maria Lopez in unit 304 at 22 King St. My rent will be late this month, I lost my job last week. Can I pay half on the 1st and half on the 15th? My new card ends in 4417.

In four short sentences, that’s a name, an address, a phone number, a job loss, a financial situation and part of a card number. An AI tool that answers her will touch all of it. Here’s where it goes.

Stop one: it arrives

The text comes in through a phone or messaging provider, then reaches the AI tool.

Ask the vendor: Is it encrypted on the way in and while it’s stored? A good answer is yes, both in transit and at rest, without hesitation. Ask too which other companies the message passes through, such as a phone provider and an AI model provider. A good vendor has a list of these and will share it.

Stop two: the AI reads it

To understand Maria and reply, the tool sends her message to an AI model, usually run by a separate company.

Ask: Is our data used to train any AI model? The answer should be a clear no, in writing. Business plans from the large AI providers generally don’t train on customer data, but a vendor’s own terms can still allow it, so ask about both the vendor and the model providers behind it, and where the answer is written down. Some vendors put it in their privacy policy, like Omnia by Tuze, whose privacy policy says its AI providers can’t use calls and messages to train their own models.

Stop three: it’s stored

Maria’s message and the reply become part of her record, so the next person who helps her can see what was said.

Ask: Where is it stored? Storing data in the US is allowed across most of Canada, as long as it’s protected by contract and you’re open about it. Some companies still prefer it kept in Canada. Quebec requires an assessment before personal information goes outside the province. Either way, you should know the answer before signing.

Stop four: people see it

Maria’s manager needs to see the message. The vendor’s whole support team probably doesn’t.

Ask: Who on your team can see our data, and when? A good answer is a small number of people, only when needed to support you, with access logged. Ask the same about your own side. Can you limit what each person in your company sees, such as keeping owner statements from a leasing assistant?

Stop five: something goes wrong

Even careful companies have incidents.

Ask: If there’s a breach, how fast will you tell us, and what will you send? A good answer gives a time frame and says what they’ll share, so you can meet your own duties. In Canada, organizations have to report breaches that pose a real risk of significant harm and notify the people affected. Most US states have breach notification laws too.

Stop six: it’s deleted

Maria pays, moves out two years later, and her file closes.

Ask: How long do you keep our data, and how do we delete it? A good answer gives you control: you can delete a record, and when you leave the vendor, you can export everything and they’ll delete their copy within a set time. Keeping data forever with no way out is the answer to worry about.

What doesn’t belong in the message at all

Look back at the end of Maria’s text: part of a card number. Even with a careful vendor, some information shouldn’t flow through a conversation. Card numbers, full bank details and government ID numbers belong in a payment or verification system, not a chat. A well-built AI tool should point the resident to the right place for it and never repeat the number back.

The same goes for your team. Free consumer chatbots are a different kind of tool from business software, and how to use ChatGPT in property management covers what to keep out of them.

Get it in writing

Answers on a sales call are a start. The ones that count are in the contract, the data processing agreement and the privacy policy. Ask for them, read the sections on training, storage, access, breaches and deletion, and keep a copy with the vendor’s file. Under Canadian privacy law your company stays accountable for information it hands to a vendor, and in the US your residents will hold you responsible either way, so the paperwork is part of the protection.