Most real estate investors don't think twice about signing up for Stessa, Baselane, or TurboTenant. The apps are free, they're polished, and they solve a real problem: tracking rental income and expenses is a pain. Why not let someone else handle the infrastructure?
The answer is that "free" cloud tools don't exist in a vacuum. They're businesses. And businesses need to make money. When the product is free, the revenue comes from somewhere else, usually from you, in ways you didn't fully agree to when you checked the Terms of Service box.
Let's walk through exactly what you're giving up when you store your real estate portfolio data in the cloud, and why that matters more than most landlords realize.
What's actually in your portfolio data
Before we get into the risks, it's worth being specific about what you're uploading to these services. When you use a cloud-based landlord tool, you're typically storing:
- Every property address you own. Anyone with access to the database knows your full real estate footprint.
- Mortgage balances and lenders. How much you owe on each property, to whom, at what rate.
- Monthly rental income per property. What each unit earns, across your entire portfolio.
- Tenant names, contact information, and payment history. Including whether specific tenants pay late.
- Every expense, repair bill, and capital expenditure. A detailed financial history of each property.
- Scanned documents, leases, mortgages, tax bills. Often uploaded to cloud storage attached to your account.
- Your net worth, essentially. Equity positions, total portfolio value, cash flow history.
This is a complete financial profile. Not just bank transactions, but a structured, curated view of your real estate wealth that would be enormously valuable to lenders, real estate agents, competing investors, marketers, and data brokers.
Risk 1: Data monetization, the Stessa/Roofstock example
In 2022, Stessa was acquired by Roofstock, a real estate marketplace that helps people buy and sell investment properties. Think about what that means for a moment.
Stessa now sits inside a company whose core business is selling real estate transactions. Their incentive is to match buyers with sellers, earn commissions, and grow their marketplace volume. They now also happen to have access to detailed portfolio data for thousands of real estate investors.
Stessa's privacy policy, like most SaaS privacy policies, permits them to use "de-identified" or "aggregated" data for their business. It permits sharing with "affiliated companies", which now includes Roofstock. It permits analysis of usage patterns and property data to improve their services.
None of this is illegal. It's standard practice. But it means your property addresses, equity positions, and cash flow data are now inside a real estate marketplace that has a financial incentive to act on that information.
This isn't a conspiracy theory. It's the logical outcome of a VC-backed acquisition. When a marketplace buys a portfolio tool, portfolio data becomes a strategic asset. The only question is how aggressively they choose to use it.
Risk 2: The acquisition and shutdown risk, Cozy.co
Cozy.co was one of the most popular free landlord tools of its era. It offered free rent collection, tenant screening, and lease management. Thousands of landlords depended on it. In 2018, it was acquired by CoStar Group, a commercial real estate data giant.
In 2020, CoStar shut Cozy down and migrated users to Apartments.com, a consumer-facing rental listing platform with a completely different focus. The free tools that landlords had built their workflows around were gone.
Landlords who had years of tenant history, lease documents, and payment records stored in Cozy lost access to that data unless they manually exported it before the deadline.
The pattern is consistent across SaaS: build a free product, accumulate users and data, get acquired by a larger player with different priorities, pivot or shut down the original product. The acquired company's users rarely come first in those decisions.
If your portfolio history is locked inside a cloud tool and that tool gets acquired, shut down, or pivots away from your use case, you have to scramble to export your data before the deadline, hope the export format is usable, and rebuild your workflow elsewhere.
Risk 3: Price increases and feature paywalling
Baselane launched with the promise of free landlord banking and free ACH transfers. Over time, ACH transfers moved to $2 each. Card transactions carry a 3.49% fee. Premium features are gated behind paid tiers.
Stessa has progressively moved features behind its paid "Stessa Pro" tier that were previously available to free users. The platform that landlords chose because it was free is now partially behind a paywall, and those landlords' data is already locked in the system.
This is a well-documented pattern in SaaS. It's sometimes called "boiling the frog", introduce a free product, build switching costs by becoming indispensable to your users' workflows, then gradually introduce pricing as the user base is locked in. The technical term for this is "vendor lock-in," and it's a deliberate strategy, not an accident.
The problem with cloud tools isn't that they're bad products. It's that their incentives diverge from yours over time. Initially, they want users. Later, they want revenue. Your data is what prevents you from leaving when that transition happens.
Risk 4: Data breach exposure
Cloud databases are high-value targets. A breach at a major landlord tool would expose property addresses, mortgage balances, tenant information, and net worth data for potentially hundreds of thousands of real estate investors at once.
This isn't hypothetical. In 2021, RealPage, a major property management software company, disclosed a data breach affecting tenant screening records. In 2019, a breach at First American Financial exposed millions of real estate transaction records going back to 2003. The real estate and property tech sector is a rich target.
When your portfolio data lives on a single cloud provider's servers, a breach there exposes everything simultaneously. When your data lives on your own device, encrypted with a key that never leaves your machine, there is no cloud database to breach.
Risk 5: Government requests and legal exposure
A cloud provider storing your financial data can receive a subpoena, government request, or law enforcement inquiry, and they're generally required to comply without notifying you. Your property addresses, income records, and tenant history can be turned over to government agencies, opposing counsel in civil litigation, or regulatory bodies without your knowledge or consent.
This isn't a paranoid concern. Real estate investors are routinely involved in civil disputes, tenant litigation, landlord-tenant boards, HOA disputes, divorce proceedings, business partner disputes. In any of these situations, records held by a cloud provider are discoverable through legal process.
Data that never leaves your device is not subject to third-party subpoenas in most jurisdictions. If your encrypted database is on your Mac, requests go to you, not to a cloud provider who has been storing and can hand over your records.
The alternative: local-first software
Local-first software is the philosophy that your data should live on your device, controlled by you, with no cloud intermediary. The application runs locally. The database is stored locally. Encryption is applied at rest on your machine.
This isn't new. Before SaaS, all software worked this way. QuickBooks started as a desktop app. Your tax software probably still runs locally. There's nothing technologically inferior about a local app, in many ways, it's faster, more reliable, and more private than a cloud equivalent.
SealedFolio applies this philosophy to real estate portfolio management. Your properties, transactions, tenants, mortgages, and documents are stored in an encrypted database on your Mac. We never see your data. There is no cloud server to breach. There is no acquisition that can hand your financial records to a real estate marketplace. There is no price increase that can hold your own data hostage.
You can still export to CSV, share reports with your accountant, and back up to your own encrypted cloud storage (like an encrypted Dropbox or iCloud drive). The difference is that you control when and how that happens, not a SaaS provider with misaligned incentives.
What to look for in a private portfolio tool
If you're evaluating portfolio tools with privacy in mind, here are the questions to ask:
- Does it run locally? Is the application a native desktop app, or does it require an internet connection to function?
- Where is the data stored? On your device, or on the company's servers?
- What encryption is applied at rest? Is your database encrypted before it's written to disk?
- Who holds the encryption key? If the company can decrypt your data (i.e., if they hold the key), then your data is effectively accessible to them and anyone who breaches their systems.
- What does the privacy policy say about data use? Specifically around aggregated data, affiliated companies, and business purposes.
- Who owns the company? Is it VC-backed and under pressure to monetize? Is it owned by a strategic player (like a marketplace) with conflicting interests?
Conclusion
Cloud property tools made sense when the alternative was a spreadsheet and a filing cabinet. But the tradeoffs have changed. Your portfolio data is more valuable than it's ever been, to you, and to the companies that store it.
The risks of cloud storage, data monetization, acquisition, shutdown, price increases, breaches, and legal exposure, are not hypothetical. They've happened to real landlords using real tools. The pattern will continue.
Local-first portfolio software gives you everything a cloud tool offers, analytics, reports, document storage, tenant management, tax exports, without requiring you to hand your financial life to a third party. The technology exists. The question is whether privacy is a priority for you.
If it is, SealedFolio is worth a look.