All plans, including Free
·
iOS, Android, web
REPSLog Data Security and Backups cover how your hour log is stored, who can reach it and how it is recovered if something fails. Your entries, properties and attachments are encrypted in transit and at rest, backed up every day, and readable only by your account and the people you invite. This applies on iPhone, Android and the web app, on every plan, for every real estate investor keeping REPS or STR loophole records.
What it does
Your account, entries, properties, categories, participants and the files you attach are stored on Google Cloud (Firebase), the same infrastructure Google uses for its own products. All data is encrypted in transit and at rest.
Access is scoped to your account. The rules that guard the database and file storage check the signed-in user on every read and write: your log is readable and writable by you, and by a person you invited through Team Access who accepted. Read Only delegates can view and export; Full Access delegates can also create entries and manage properties and categories, but cannot manage your subscription, delete your account or share access further.
Backups run automatically every day, with integrity checks, so the service can be recovered after a failure. Each backup expires on its own: new backups are kept for 30 days, and none is kept longer than 60 days. REPSLog does not restore a backup to bring back information you asked to have deleted.
You can keep your own copy at any time. Export My Log in Settings produces your entries for a tax year as CSV and PDF, with the option to include your supporting evidence attachments (for an Airbnb or Vrbo host, the cleaner invoices and guest-stay records behind each turnover), on every plan. The export is what you hand to your CPA.
Sign-in is designed so a stolen password is not the weak point. Passkeys use Face ID, Touch ID or your device unlock, magic links expire after 15 minutes and work once, sign-in emails are rate limited, and an email change must be approved from both the old and the new inbox and signs you out on every device. Credentials for connected calendars are stored encrypted, and deleting your account removes them along with any API keys.
Deletion is self-serve. Settings, Delete Account removes your entries and files, properties, categories, participants, settings and every connection, plus everything derived from them, and takes effect straight away in the app. A copy can remain in routine backups until they expire, isolated from any further use. Billing and tax records, referral records and support history are kept on purpose; the confirmation says so.
REPSLog also monitors errors and crashes and records how screens are used so broken things get found. What you type into a field is masked in those recordings.
How it works
Sign in with a passkey, a magic link, Google or Apple.
Log entries and attach evidence as usual. Everything is encrypted on its way to the server and while it sits there.
To give a spouse, assistant or CPA access, use Settings, Manage Account Access, and choose Read Only or Full Access. Their access is checked on every request and can be removed by you at any time.
To keep your own backup, open Settings, tap Export My Log, pick the tax year and choose whether to include attachments.
Review what leaves your account for AI features in Settings, AI and Privacy, and turn any of it off.
If you ever want out, open Settings, tap Delete Account and confirm. Your log is gone from the app immediately.
Why it matters for your hours
A REPS or material participation log is only useful if it still exists, unchanged, when the IRS asks for it, which can be years after the tax year. Daily backups protect against a failure on our side. Encryption and per-account access rules protect a record that names your properties, your contractors and your time. Sign-in that resists a leaked password keeps the log editable by you alone.
The export closes the loop. Your CPA gets the year’s hours as CSV and PDF, you keep a copy, and the live log stays in the app for the next year. Ask your CPA how long they want you to retain the underlying records.
If you host on Airbnb or Vrbo and use the STR loophole, your evidence is spread across people. The test is 100 hours per short-term rental by default, and more than anyone else who worked on it, so the cleaner, co-host and manager are logged as participants, with their invoices and the guest-stay evidence attached to entries at each property. Those files are encrypted in transit and at rest, backed up daily, and readable only by your account and the delegates you choose, so the record showing you out-logged your cleaner at each listing is there when asked for. Export My Log with attachments hands your CPA the same set.
Good to know
Available on every plan, including Free, on iPhone, Android and the web app.
Encrypted in transit and at rest. Stored on Google Cloud (Firebase).
Daily automated backups with integrity checks. New backups are kept 30 days; none is kept beyond 60 days. Backups are never used to undo a deletion you asked for.
Access is per account. A delegate sees your log only after accepting your invitation, at the level you chose (Read Only or Full Access).
Export My Log (CSV and PDF, with or without attachments) is on every plan and is your own copy.
Magic links: 15 minutes, single use. Passkeys: Face ID, Touch ID or device unlock. Email changes: confirmed from both inboxes, then signed out everywhere.
Deleting your account takes effect immediately in the app and cannot be undone. Billing and tax records are retained because the law requires it; referral and support records too.
AI features that read your log are listed in Settings, AI and Privacy, each with a switch. Attachment reading is off until you turn it on.
Full detail on every provider and retention period is in the Privacy Policy.
Frequently asked questions
Where is my REPSLog data stored?
On Google Cloud (Firebase). Your account, entries, properties and attached files are encrypted in transit and at rest.
Is REPSLog data backed up?
Yes. Backups run automatically every day with integrity checks. New backups are kept for 30 days, and none longer than 60 days. They exist to recover the service after a failure, not to restore data you deleted.
Who can see my hour log in REPSLog?
You, and anyone you invite through Team Access after they accept, at the level you set (Read Only or Full Access). Staff can reach your content only where that is needed to run or support REPSLog.
Can I download a copy of my REPSLog data?
Yes. Settings, Export My Log gives you your entries for a tax year as CSV and PDF, with attachments if you want them, on every plan.
Can I delete my REPSLog data?
Yes. Settings, Delete Account removes your log, files and everything derived from them straight away. Billing, referral and support records are kept on purpose, and a copy can remain in routine backups until they expire on their own.
Are my cleaner invoices and short-term rental records safe in REPSLog?
Yes. Files you attach to entries are encrypted in transit and at rest on Google Cloud (Firebase), backed up daily, and readable only by your account and the people you invite. Export My Log can include them for your CPA.
Is a cloud app a safe alternative to keeping my REPS log on my own computer?
A single copy on one computer is one accident away from gone. REPSLog keeps your log encrypted in transit and at rest, backed up daily, and available on every device you sign in to, with export at any time.
Related features
Learn more
The Help Center describes where your data lives and who holds part of it: REPSLog Data Security: Where My Data Is Stored and How It’s Protected
From the blog: Is my REPS hours log private and backed up?.
Try REPSLog free for 14 days on iOS, Android or the web app.