MapMyWater Security Overview
Last updated: July 24, 2026
Pre-release legal draft: This revision is awaiting review by qualified California counsel and must not be promoted to production until the owner approves that review gate.
MapMyWater stores private property mapping records for landscapers, irrigation contractors, HOAs, and property teams. Security is designed around private workspaces, paid-account access, and read-only sharing when a customer chooses to publish a scoped map view.
Account access
- Workspace access requires a signed-in account.
- Map editing is gated behind active or trialing subscription status.
- Admin operations are protected server-side through staff role checks.
Billing data
Stripe handles subscription checkout and payment method management. MapMyWater stores Stripe customer and subscription identifiers, not card numbers.
Property records
- Private map data is scoped to workspace membership.
- Read-only share links expose only the selected shared map summary.
- Service-role credentials and Stripe secret keys are used only in server API routes.
Operational safeguards
- Sensitive APIs re-check authorization on the server and use rate limits.
- Stripe and email webhooks require provider verification and idempotent processing.
- Owner map grants and other sensitive actions create audit records.
- Production and mailbox-level sending pauses provide an emergency stop for outbound operations.
This overview describes current design goals and implemented controls. It is not a representation that MapMyWater holds a particular security certification or that risk can be eliminated.
Questions or reports
Send security questions or suspected issues to support@mapmywater.com. Include the affected workspace, approximate time, and steps to reproduce if possible.