HOA Software Administration and Security

This document is the current source of truth for HOAfy settings, access control, association setup, subscription billing, security, Copilot, and cross-platform availability. It describes implemented behavior and material limitations.

Association and Personal Settings

Association settings include name, address, community type, fiscal-year configuration, size, and related profile information. The slug drives durable identifiers such as the public website and mailbox; the current details screen treats it as read-only after setup.

Confirm the timezone and fiscal-year start month before saving accounting records. HOAfy blocks changes while accounting history exists, including a saved open period or draft journal; posting a transaction or closing a year is not required. Merely viewing the calculated calendar does not lock the settings. Set the calendar before recording activity: a settings save submitted at the same time as the first accounting record may race with that record. The Periods page uses the association's creation month as the starting point for its monthly calendar, defaults to the current fiscal year, and retains access to saved historical periods. See Accounting Periods for monthly closing, year-end review, and Account Owner reopening rules.

Domain settings include Stripe Connect and fee mode, late fees, SMS registration, website publishing, calendar feeds, subscription billing, Copilot tokens, and activity history. A disabled or absent field must not be represented as an active configuration.

Users can manage profile fields, avatar, phone, and communication preferences. The sign-in email is identity-bound and generally read-only. Messaging phone numbers should use E.164 format. Preferences work alongside provider consent and legally required delivery rules.

Roles and Permissions

HOAfy uses 13 fixed association roles and API-enforced permissions. Role grants, permission implications, unit and ownership boundaries, and the separate vendor-workspace role model are documented in the complete HOA Roles and Permissions reference.

A person can have a different role in each association. Selecting an association reloads permissions, menus, unit access, and the role-aware dashboard. Customer-defined roles and permission sets are not currently available. Some web controls use broad administrative groupings while routes use exact backend permissions; the API is the final authorization boundary. Account Owner removal requires consent and is not an ordinary profile edit.

Multi-Association Access

One login can belong to several associations. The application shows an association selector and isolates records and permissions to the active association. Property managers can operate each assigned community without separate credentials.

Current access is association by association. HOAfy does not currently provide a complete management-company organization workspace with organization roles, staff assignment, centralized billing, portfolio operations, cross-community search, shared templates, bulk actions, or portfolio-wide Copilot.

HOAfy Subscription Billing

Subscription status, stored payment method, monthly or annual cycle, discounts, invoice history, and billing automation are available and depend on Stripe configuration. This is separate from owner assessments and association accounting.

The community pricing strategy last updated in August 2026 uses one plan for currently released core features, tiered by unit count:

Annual pricing is charged annually even when expressed as a monthly equivalent. Current terms describe a 30-day trial without a required card, no long-term contract, and no HOAfy cancellation fee. Provider fees and already-incurred usage or service charges are separate. Always verify the live pricing page and checkout before quoting.

The previously documented $299/month management-company portfolio price does not describe a generally available product because the organization-level workspace is incomplete.

Cancellation should identify its effective date, retained public-website behavior, available data outputs, and nonrefundable charges. A one-click full association export is not currently available.

Security, Audit, and Administration

Authentication uses Amazon Cognito and association-scoped authorization. MFA and recovery availability depend on the configured Cognito flow. Individual identities are required for permission enforcement and auditability; users should not share accounts.

The activity log records supported create, update, delete, status, and administrative events with actor and context. It complements rather than replaces financial reports, minutes, provider logs, and legally required records.

The platform uses encrypted transport and managed AWS encryption at rest. Provider credentials belong in managed secrets, not free-form settings or uploaded documents. HOAfy does not currently claim per-association custom encryption keys, SSO, or complete SOC 2 certification.

Internal platform-admin tools provide active-association visibility, controlled administrative commands, and member impersonation. These are support capabilities, not association roles.

Provider and Deployment Dependencies

Repository implementation does not by itself prove that a provider is configured or healthy in production. Production readiness must be verified separately.

Association Creation and Setup

Watch association setup in the demo

Association creation asks for the community name and a unique URL slug. The slug uses lowercase letters, numbers, and internal hyphens; it cannot start or end with a hyphen. It is used by the community URL and association email identity. The creator becomes Account Owner.

Creation also establishes default messaging groups, request types, draft website pages, and website configuration. Accounting funds and protected system accounts are provisioned idempotently when Accounting is initialized.

The resumable setup wizard contains:

1. Association profile: name, address, type, fiscal-year start, and unit-count tier. This is the only required step.
2. Board members: optional invitations and role assignment.
3. Roster: units, owners, board members, and residents from CSV.
4. Financial setup: Stripe Connect and opening-balance import entry points.
5. Homeowner invitations: review and send portal access.

Optional steps can be skipped. Dismissing the wizard preserves progress, and dashboard checklist completion is based on association data rather than only wizard position.

The recommended setup order is profile, units, members and ownership, chart of accounts and funds, billing opening data or history, documents, provider connections, and invitations. Complete a full-history conversion before creating any other invoices or payments. See HOA Data Import, Migration, and Export for supported formats, validation rules, limits, and migration sequencing.

HOAfy Copilot

Watch HOAfy Copilot in the demo

HOAfy Copilot is available when its AI provider, product API, and token metering are configured. It is an association-scoped administrative assistant that uses the signed-in user's normal product APIs.

Current access is limited to Account Owners and board roles with UseCopilot. Homeowners, residents, vendors, and Property Managers do not receive access unless their association role grants that permission. Copilot is hidden in Vendor Mode.

The shared tool catalog covers association setup, calendar, accounting, billing, budgets, communications, documents, invoices, members, payments, profiles, reports, requests, units, vendors, violations, voting, and public-site configuration. Both read and write tools exist; the API performs final authorization and validation.

One turn is capped at eight tool-calling rounds. The panel supports Markdown, tool status, usage limits, navigation links, and conversation reset. Conversation context is client-held and is not a durable searchable transcript.

Copilot is instructed to confirm consequential changes, but this is assistant behavior rather than an independent server-side approval transaction. It cannot close an accounting period or send/schedule a mass communication through its current tool surface. It does not replace legal, tax, accounting, approval, signature, or board-vote workflows.

Usage is metered per association by calendar month. The panel shows allowance and remaining tokens. Eligible associations with a payment method can currently purchase 1,000,000-token packages for $10, up to ten packages per purchase. Checkout is authoritative because package policy can change.

Copilot operates only in the selected association, cannot bypass permissions, and does not provide portfolio-wide queries. Users must not submit card numbers, bank credentials, passwords, government identifiers, or unrelated personal data.

External MCP

HOAfy provides a remote Model Context Protocol (MCP) server at mcp.hoafy.com. Compatible clients connect to the full Streamable HTTP endpoint:

https://mcp.hoafy.com/mcp

The endpoint accepts JSON-RPC 2.0 over HTTPS POST and supports the MCP initialize, ping, tools/list, and tools/call methods. It is stateless: clients do not receive a durable MCP session, and the server currently exposes tools rather than MCP resources or prompts.

Authentication and Setup

The MCP endpoint requires a current HOAfy JWT in the Authorization: Bearer <token> header. The client must support remote Streamable HTTP servers and custom authorization headers. Connect to the full /mcp URL rather than only the domain.

HOAfy validates the token at the gateway and forwards the same authorization to the product API for every tool call. The MCP server stores no separate customer credentials and cannot gain permissions the signed-in user does not have. Expired tokens must be refreshed through HOAfy sign-in and updated in the client. A first-party MCP OAuth discovery or guided client-configuration flow is not currently provided.

Treat the bearer token like a password: store it only in the MCP client's secure configuration, do not paste it into prompts or documents, and remove it from clients that should no longer have HOAfy access.

Tool Scope and Permissions

The external server uses the same product tool catalog as embedded HOAfy Copilot. It includes read and write tools for association setup and audit history, calendar, accounting, billing, budgets, communications, documents, invoices, members and invitations, payments and Stripe status, personal profiles, reports, requests and work orders, units, vendors, violations, voting, and public-site administration.

Most tools require an associationId. Use list and get tools to discover association and record identifiers before calling create or update tools. Every operation remains subject to the caller's association membership, role permissions, API validation, subscription limits, and provider configuration. Switching an MCP client to another association requires using that association's identifier; the server does not provide portfolio-wide access or bypass normal authorization.

The MCP surface intentionally omits HTTP DELETE operations and selected consequential actions, including creating payment intents, enrolling autopay, sending a mass communication, voiding invoice batches, merging units, purging voting identities, and closing accounting periods. Reversible and status-oriented operations can still change production data. Review the proposed tool name and arguments in the client before approving a write.

Tool availability does not prove that Stripe, Plaid, SMS, email, website deployment, or another external provider is configured and healthy. API errors are returned to the MCP client as tool errors for the client or user to correct.

Mobile Experience

Watch the iOS and Android apps in the demo

The HOAfy mobile app covers the same feature areas as the website in a mobile-friendly experience. Users can switch associations and access the features allowed by their role, including payments, requests, violations, documents, voting, calendars, directories, profiles and preferences, accounting, reports, communications, members, units, work orders, and vendors.

The mobile app also adds the Community Messenger for association group conversations. HOAfy does not guarantee exact feature parity between the website and mobile app. New and advanced capabilities may appear on the website before they become available on mobile.

Community Messenger

The Community Messenger gives association members a shared place for conversations organized by the association. It is separate from the association mailbox and email or SMS campaigns.

An authorized administrator sets up Messenger access in two steps:

1. Create an Audience that describes who should participate, such as all residents, board members, owners, members of selected units, or another supported combination of member criteria. Preview the Audience to confirm who currently matches it.
2. Create a Group and connect it to that Audience. The administrator provides the group's name and optional description or icon, chooses its notification and message-retention defaults, and can later archive the Group.

Audience membership is evaluated from current association records. When a person's role, status, unit relationship, or other matching information changes, the Groups available to that person can change as well. New associations include Residents and Board Groups for their corresponding Audiences.

In the mobile app, a member sees the active Groups whose Audiences include them. The Messenger shows each Group's name and icon, recent activity, unread status, and mute setting. Opening a Group shows its conversation and allows the member to read and send text messages. A member does not see Groups for Audiences they do not belong to, and archived Groups are removed from the normal Group list.

Operating Guidance

• Grant least privilege and review roles after board or management changes.
• Use individual identities instead of shared board accounts.
• Keep provider secrets out of settings notes and documents.
• Verify Stripe, Plaid, SMS, DNS, and mailbox readiness before launch.
• Verify prices and token packages in the live checkout.

Support Answers

• Can one person manage several associations? Yes. They switch among assigned associations, with separate roles and data in each.
• Does HOAfy support custom roles? No. Current access uses fixed roles and permissions.
• Is every released feature included in the community plan? Released core software is not tier-gated under the current one-plan strategy; provider transactions, SMS allowances, optional services, and unavailable features are separate.
• Is there a HOAfy cancellation fee? Current terms say no, but already-incurred subscription periods, provider fees, usage, and services are not automatically refunded.
• Can Copilot see every managed association? No. It operates only in the selected association.
• Can Copilot create or send a campaign? It can create a draft campaign, but it cannot send or schedule the campaign through its current tool surface.
• Why can Copilot refuse an action? Common causes are missing permission, API validation, provider configuration, or exhausted tokens.
• Does clearing Copilot chat delete records? No. It clears only client conversation context.

Related Topics

• HOA Financial Management
• HOA Email, SMS, and Community Communications
• HOA Community Management
• HOA Data Import, Migration, and Export
• HOA Vendor Management and Work Orders