Passwordless sign-in
Homesrolo emails a short-lived six-digit code that you type into the same app. The web app receives an opaque Secure, HttpOnly session cookie—not your email-provider login or a token exposed to page code.
Security
The public site and the home record stay separate.
Homesrolo uses a static public website for guides and a separate authenticated application for homeowner data. The current controls are designed around the exact account, exact home, and narrow action being requested.
Exact-home authorization
Private reads and writes check the signed-in account against the exact home requested. A home, project, or photo identifier by itself is not permission.
Private photo delivery
Checkup photos are served through authenticated same-home routes. Storage locations and provider credentials are not returned to the browser.
Narrow file boundary
Private home files accept bounded PDF, JPEG, and PNG uploads. Seasonal checkups use their own image-only path, enforce count and size limits, and re-encode images before private storage.
Protect your sign-in code
Treat an emailed sign-in code like a password. Do not forward it, paste it into a support message, or share a signed-in device with someone who should not see the home record. Sign out when using a shared browser.
If a code arrives that you did not request, do not use it.
Report a security concern. Text (817) 886-2418 and begin with SECURITY. Describe the issue without sending a password, sign-in code, private photo, policy number, or full address in the first message.