Security & Trust

How GovHomes protects your information

You are asked to register with an official .gov or .mil address. This page explains exactly what happens to that address, what member verification does and does not prove, and how to protect yourself from rental fraud while you're moving.

Your email address is encrypted at rest

Your official address is the one piece of personal information GovHomes requires, so it gets the strongest handling we can give it. It is encrypted before it is written to disk. The database stores ciphertext and nothing else — there is no column anywhere holding a readable copy of your address.

What lands in the database

You register with

jane.doe@agency.gov

We store

{"p":"Ux9tK2vQ…","h":{"iv":"…","at":"…"}}
Authenticated AES-256 encryption
Addresses are sealed with AES-256-GCM. GCM is an authenticated mode, which means ciphertext that has been altered fails to decrypt rather than quietly returning a wrong value. We use the encryption built into our web framework rather than anything hand-rolled.
Encryption keys are held outside the database
Keys live in protected server configuration — never in the database itself, and never in our source code. A copy of the database, on its own, decrypts to nothing. Key management, not the cipher, is the real security boundary, and the keys are backed up separately from the data they protect.
Strict mode: there is no plaintext fallback
The platform runs with support for unencrypted data switched off. There is no legacy code path that will read a raw address; if an unencrypted value ever appeared in the column, the application rejects it instead of silently accepting it.
Addresses stay out of our logs
Application logs, error reports, and background jobs are written to record what happened without recording who it happened to. Our maintenance tooling reports counts, not addresses.

Straight talk about the boundary

Encryption at rest protects your address where it is most likely to be exposed: a stolen backup, a leaked database dump, a read-only breach, or someone with direct database access. It is not a claim that no system can ever read your address — GovHomes decrypts it to send you mail, and a platform that tells you otherwise while still emailing you is overselling. It also would not, on its own, stop an attacker who compromised the running application. What we commit to is narrower and verifiable: your address is never stored in the clear, the keys are kept apart from the data, and no other member is ever shown it.

What member verification means

Registration requires a working .gov or .mil email address, confirmed with a code sent to that address. That keeps the marketplace to people who currently hold a federal or military account — which is what makes renting to a stranger here different from renting to a stranger anywhere else.

What it does tell you

  • The member controls an active .gov or .mil mailbox.
  • They are currently employed by, or serving in, the federal government or armed forces.
  • They have been through their agency's or branch's own onboarding and vetting to hold that account.

What it does not tell you

  • It is not a security clearance and not a background investigation run by us.
  • It does not verify that a listed property exists, is habitable, or is legally rentable by that member.
  • It is not an endorsement by any agency, branch, or the U.S. Government.

Listings may also be posted by realtors, property managers, and leasing agents, who are not federal employees. Treat verification as a strong signal about who you are talking to — not as a substitute for checking the property.

Your information inside the platform

Members never see your email

Your address is not displayed on your profile, on your listings, or to anyone you talk to. Contact happens through in-platform messaging, so you can end a conversation without having handed out a way to reach you.

Messaging stays in-platform

Conversations with owners, managers, and agents run through GovHomes. Keeping them here means there is a record if something goes wrong, and no reason to share a personal phone number or address early on.

You control your listings

You decide what goes on a listing and what does not. Photos and descriptions are yours to edit or remove at any time, and removing a listing takes it out of search immediately.

Avoiding rental fraud during a move

Rental scams target people who are relocating on a deadline, sight-unseen, from another time zone — which describes most PCS and reassignment moves. Verification raises the bar for who can reach you here, but no marketplace can inspect a property for you. These habits are what actually protect you.

Warning signs worth walking away from

  • You're asked to wire funds, send a deposit by gift card or cryptocurrency, or pay through an app that offers no buyer protection.
  • The rent is well below comparable homes in the area, with an urgent reason you must decide today.
  • The other party refuses a walkthrough, a video tour, or a call, and will only communicate by text or off-platform email.
  • You're asked to move the conversation off GovHomes early, especially before any details are agreed.
  • The person cannot produce proof they own the property or are authorized to rent it, or the name doesn't match public property records.
  • You're pressured to sign or pay before you have seen a written lease with the full terms.

Before you pay anything

  1. See the property — in person, or by live video walkthrough where you can ask the other person to show you specific rooms on request.
  2. Confirm the other party's authority to rent it. Owners can show a deed or tax record; managers and agents can show a management agreement or license number.
  3. Get the full lease in writing and read every term, including deposit, utilities, and the conditions for getting your deposit back.
  4. Pay by a traceable method that leaves a record. Never send funds to someone you have not met or verified.
  5. Keep the conversation on GovHomes so there is a record of what was agreed.

GovHomes does not own, manage, inspect, or appraise any property, does not hold deposits or process rent, and is not a party to any lease. Listing details are supplied by members and are not independently verified. If a listing or a member looks fraudulent, stop the conversation and report it so we can remove them.

Ready to join?

Registration takes a few minutes and needs nothing but your .gov or .mil address — encrypted the moment you register.

Create Account