Skip to main content
RentSpirePHA Solutions

Compliance, comps, and casework — one platform.

PHA StaffCasework, rent reasonableness, payments LandlordsCommunities registry, payments, W-9/1099 ResidentsReport a change, find a community

Browse Real-Time PHA Data

Loading sign-in…

Pick your housing authority to browse its portal on live data. No account needed.

You only see your own state's communities and comps. Browsing writes nothing. Every determination is captured to an audit trail you can hand to HUD.
Explore the evidence Assurance Matrix How We Prove It Data & Provenance
Compliance posture

Every mandate on your desk — and the three landing next.

A new cyber-reporting duty, a HOTMA enforcement date and an NSPIRE deadline all land within seven months of each other — against 11 publicly reported PHA cyber incidents since 2019, the latest discovered in June 2026. Every claim below links its dated HUD notice or CFR section.

  • New — July 8, 2026 Notice PIH 2026-17

    36-hour cyber incident reporting

    Notify CIRT@hud.gov and your field office within 36 hours of a cyber incident (takes effect on OMB PRA approval).

    How we answer it
    • Every protected read writes an append-only ledger row — the app cannot edit or delete it
    • Your incident timeline is a query, not a forensics engagement
  • Enforcement Jan 1, 2027 PIH 2026-15 · 88 FR 9600

    HOTMA §§102 / 104 income and assets

    The $100,000 asset limit and $50,000 self-certification threshold (24 CFR 5.618) bind PHAs January 1, 2027 — with 120-day reexam scheduling you collect to it in September 2026.

    How we answer it
    • HOTMA-aware income and asset capture
    • Versioned SQL rules do the regulated math — never a language model or a regex
    • The rule version is recorded on every determination
  • Compliance Feb 1, 2027 90 FR — Sept 30, 2025

    NSPIRE for HCV, PBV and Mod Rehab

    HUD's third extension sets February 1, 2027 as the NSPIRE compliance date for HCV, PBV and Mod Rehab.

    How we answer it
    • An explicit statutory clock on every inspection case
    • Scheduled, conducted, cured and re-inspected are first-class dates
    • The clock is scanned for risk before it runs out
  • In force today EIV Security & Training Guidance (PIH 2018-18) · HUD-52676

    EIV security awareness training

    Every EIV user needs security-awareness training in each 12-month period, with auditable records — a duty HUD places on the PHA.

    How we answer it
    • Training expiry is enforced, not tracked
    • Lapsed training → the database itself refuses protected reads
    • No dashboard to ignore, no report to reconcile
  • In force today Notice PIH 2015-06

    Privacy Act and PII safeguards

    Safeguard resident PII and furnish the Privacy Act notice at application and every annual reexamination, with auditable evidence.

    How we answer it
    • Every resident field carries a server-side sensitivity tier
    • Protected reads require a stated case and purpose, recorded with the read
    • SSNs and bank identifiers rest as last-four + hash only
  • In force today 24 CFR 982.507 · 982.158

    Rent reasonableness and the 3-year record

    Determine before the HAP contract; redetermine on a rent increase, a 5% FMR decrease, or on doubt — eleven factors at 982.507(b), records kept three years.

    How we answer it
    • All eleven statutory factors on every determination
    • Comps, weighting and rule version frozen into the record
    • Reproducible three years later — exactly as long as you must keep it

Straight Answers

The questions a procurement officer will ask anyway — answered here first.

Do you hold SOC 2, FedRAMP or StateRAMP today?+

No HUD rule requires a PHA software vendor to hold SOC 2, FedRAMP or StateRAMP, and we hold none of them today — our third-party attestation work is underway and we will publish the date and the scope when it is real. FISMA and NIST SP 800-53 do not bind PHAs (44 U.S.C. 3554), and any vendor implying otherwise is selling you a fear you do not owe. We would rather show you the controls than a badge.

Why did you build it this way?+

Because the record is not theoretical. Ransomware at HACLA (twice), 212,910 people affected and more than 8,000 Section 8 payments disrupted at Indianapolis Housing Agency, 189,008 at Cuyahoga Metropolitan, and a sensitive-data compromise confirmed at the District of Columbia Housing Authority in July 2026. Forensics in every one of those turns on whether the access log could be trusted.

What do the capability labels mean on this page?+

Every capability carries exactly one of four labels: Available (shipped and demoable today), Pilot (in production, still being hardened), Planned (scoped, not yet built) or Not configured (available, not enabled for your authority). An unbuilt capability is never shown as available. Every count on this page is queried from the production database at page load — nothing is cached or restated by hand. Questions about any solution: sales@rentspire.com

Who is responsible for the final determination?+

Your reviewer, always. This workspace produces decision-support output, not a final rent reasonableness certification — the PHA reviewer retains sole responsibility under 24 CFR 982.507. The full list is in the disclaimers below.

The Full Platform — Every Module
Real-time data counted from the production database at page load
Resident Tenancy Pipeline — Steps 01–09 RFTA intake to HUD-50058 submission, one audited flow — six of nine stations live today. +
Available means shipped and demoable today; Pilot and Planned modules are never shown as available. Questions about any solution: sales@rentspire.com
Vendor Comparison

The controls a HUD auditor asks about — and who actually publishes them.

Twelve vendors serving public housing authorities were reviewed against their own security, trust, privacy and product pages on August 15, 2026. Every cell below links the page that was read. We do not claim a competitor lacks a control — we report whether they publish one, because that is all a procurement officer can actually verify.

  • ✓Published and in scope
  • ◐Published, but scoped elsewhere
  • ○No public claim located
  • ⚠Adverse public record
  • ◆Self-disclosure
Published security and compliance posture, twelve PHA software vendors — reviewed August 15, 2026
ControlRentSpirePHA SolutionsYardiVoyager PHA / RentCafeMRI familyHAPPY · Tenmast · +2EmphasysElitePHA-Web/MCSAffordableHsg.comformerly GoSection8Nan McKay& AssociatesNeighborlyHCVKansoDoorwaysSACSCGI FederalCATS / OnCueHDSEnterprise / NextGen
Data-layer controls
Row-level isolation enforced inside the database
Not application-layer access control — the engine itself refuses the row.
Yes Row-level security enabled and forced on 11 of 11 protected base tables; direct reads by an authenticated session are refused at the engine. Reviewed Aug 15, 2026 How we can claim this →
No public claim located “Granular user security” only — Voyager PHA Reviewed Aug 15, 2026
No public claim located Physical hosting only — AssistanceCheck; form-level privileges — Tenmast Reviewed Aug 15, 2026
No public claim located Elite HCV Reviewed Aug 15, 2026
No public claim located Software overview Reviewed Aug 15, 2026
No public claim located Privacy policy Reviewed Aug 15, 2026
No public claim located Administers third-party systems — program management Reviewed Aug 15, 2026
Database per tenant All client databases are separate and unique to each tenant; this is database-level isolation, not row-level enforcement. Security page Reviewed Aug 15, 2026
Per-site secure environment Each agency may operate within its own secure environment; the statement is at the site level, not an in-database row-level-enforcement claim. Public housing page Reviewed Aug 15, 2026
No public claim located Software overview Reviewed Aug 15, 2026
No public claim located Affordable housing page Reviewed Aug 15, 2026
Unified database, RBAC HDS describes a unified database with multi-level permissions, role-based access, and security reporting; it does not publish a row-level-isolation claim. HDS Enterprise Reviewed Aug 15, 2026
Append-only audit ledger the application cannot rewrite
The control that decides whether your PIH 2026-17 incident timeline holds up.
Yes Insert-only access ledger; an authenticated session attempting to write, alter or delete a ledger row is refused. Read events are recorded server-side, not by the client. Reviewed Aug 15, 2026 How we can claim this →
No public claim located “Audit tracking” — mutable-by-default language, no immutability asserted (Voyager PHA) Reviewed Aug 15, 2026
No public claim located “Audit controls” and log-file insights only — MRI Cloud brochure Reviewed Aug 15, 2026
No public claim located Hosting Reviewed Aug 15, 2026
No public claim located Privacy policy Reviewed Aug 15, 2026
No public claim located Privacy policy Reviewed Aug 15, 2026
No public claim located Privacy & security Reviewed Aug 15, 2026
Case + field audit logs "Comprehensive case audit log" and "Detailed data field audit log" are published; append-only or immutable operation is not stated. Security blog Reviewed Aug 15, 2026
User-activity reports only Permission-locked reports collect user activity and behaviors; append-only or immutable operation is not published. Public housing page Reviewed Aug 15, 2026
No public claim located Software overview Reviewed Aug 15, 2026
Workflow tracking published OnCue publishes built-in workflow tracking that monitors every inspection-process step, not an immutable ledger claim. Affordable housing page Reviewed Aug 15, 2026
Security reporting only HDS publishes comprehensive security reporting and monitoring, not append-only or immutable operation. HDS Enterprise Reviewed Aug 15, 2026
Stated case and stated purpose recorded on every protected read
PIH 2015-06 asks you to evidence need-to-know. Most systems can only evidence who logged in.
Yes A protected-tier read requires a case identifier and a declared purpose; both are written to the ledger with the read. Purpose-less reads are refused. Reviewed Aug 15, 2026 How we can claim this →
No public claim located Cloud security Reviewed Aug 15, 2026
No public claim located Public housing software carries no security claims Reviewed Aug 15, 2026
No public claim located Elite HCV Reviewed Aug 15, 2026
No public claim located Login terms Reviewed Aug 15, 2026
No public claim located Privacy policy Reviewed Aug 15, 2026
No public claim located Privacy & security Reviewed Aug 15, 2026
No public claim located Security page Reviewed Aug 15, 2026
No public claim located FAQ Reviewed Aug 15, 2026
No public claim located Software overview Reviewed Aug 15, 2026
No public claim located Affordable housing page Reviewed Aug 15, 2026
No public claim located Products Reviewed Aug 15, 2026
Field-level sensitivity tiering of resident data
So a caseworker, an inspector and a finance approver never see the same fields by accident.
Yes Server-side field registry assigns a sensitivity tier to every resident attribute; tier governs visibility by role. Taxpayer and bank identifiers are stored as last-four plus hash only. Reviewed Aug 15, 2026 How we can claim this →
No public claim located Voyager PHA Reviewed Aug 15, 2026
Field-level encryption only SSNs and PII “encrypted at the database field level with 256 bit encryption” — encryption, not tiered authorization (AssistanceCheck) Reviewed Aug 15, 2026
No public claim located Elite HCV Reviewed Aug 15, 2026
No public claim located Login terms Reviewed Aug 15, 2026
Field-level encryption only SSN, alien ID and bank numbers 256-bit encrypted (privacy policy) Reviewed Aug 15, 2026
No public claim located Privacy & security Reviewed Aug 15, 2026
Field-level audit only Field-level handling is described as audit logging and fraud analytics, not a published sensitivity-tier or masking scheme. Security blog Reviewed Aug 15, 2026
No public claim located FAQ Reviewed Aug 15, 2026
Sensitive-data consent clause The privacy policy addresses disclosure of sensitive personal information with consent, not product field-level sensitivity tiering. Privacy policy Reviewed Aug 15, 2026
No public claim located Affordable housing page Reviewed Aug 15, 2026
No public claim located Products Reviewed Aug 15, 2026
EIV training expiry enforced at the data layer
HUD requires annual training. We make lapsed training actually stop the read.
Yes Training currency is a precondition inside the access policy itself. On expiry, protected reads are refused until retraining is recorded — with a finite, non-open-ended validity window. Reviewed Aug 15, 2026 How we can claim this →
No public claim located MFA guidance only — P260 guide Reviewed Aug 15, 2026
No public claim located HAPPY privacy, Tenmast Reviewed Aug 15, 2026
No public claim located Hosting Reviewed Aug 15, 2026
No public claim located Login terms Reviewed Aug 15, 2026
No public claim located Privacy policy Reviewed Aug 15, 2026
Sells the policy, not the control Publishes a paid model EIV policy for owners, explicitly “not intended for use in Public Housing, HCV, or PBV programs” (NMA shop) Reviewed Aug 15, 2026
No public claim located Security page Reviewed Aug 15, 2026
No public claim located FAQ Reviewed Aug 15, 2026
No public claim located Software overview Reviewed Aug 15, 2026
No public claim located Affordable housing page Reviewed Aug 15, 2026
No public claim located Products Reviewed Aug 15, 2026
Access & encryption
Authenticator-app or hardware-key second factor, stepped up before sensitive access
Email and SMS codes are phishable. HUD's own portal accepts security keys.
Yes Time-based authenticator (TOTP) enrollment with a second-level assurance step-up demanded at the moment of protected access — not once at login. Reviewed Aug 15, 2026 How we can claim this →
Yes, but scoped to HUD P260 SMS, authenticator app and physical security key, login blocked until enrolled — published for the HUD P260 integration, not claimed on the general cloud security page (P260 MFA guide) Reviewed Aug 15, 2026
Partial, self-limited MFA for “all MRI Software employees” but only “many of our MRI Cloud offerings”; no factor type named (MRI security). Not mentioned for HAPPY or Tenmast. Reviewed Aug 15, 2026
Advocacy, not a product claim Publishes MFA guidance for PHAs and states “several times a year, we help PHAs recover from the fallout of an attack,” without claiming MFA in Elite (Emphasys blog) Reviewed Aug 15, 2026
Email and SMS only “Email and text are currently available” — no authenticator app or security key published (login terms) Reviewed Aug 15, 2026
No public claim located Privacy policy Reviewed Aug 15, 2026
No public claim located Privacy & security Reviewed Aug 15, 2026
2FA, type unstated "Two-Factor Authentication" and "Multi-factor authentication" are published, but no authenticator/hardware-key factor type or protected-access step-up is stated. Security page Reviewed Aug 15, 2026
No public claim located FAQ Reviewed Aug 15, 2026
No public claim located Software overview Reviewed Aug 15, 2026
No public claim located Affordable housing page Reviewed Aug 15, 2026
No public claim located Products Reviewed Aug 15, 2026
Encryption in transit and at rest, both stated
The floor, not the ceiling — and two vendors here do not clear it publicly.
Yes TLS in transit; managed encryption at rest. Full taxpayer and account numbers are not stored at all. Reviewed Aug 15, 2026 How we can claim this →
Published TLS and “automatic encryption” (Yardi cloud security) Reviewed Aug 15, 2026 How we can claim this →
Split across the family HAPPY publishes both, including 256-bit field-level at rest (fact sheet). For MRI itself, encryption is not mentioned on the security page or the cloud brochure; not mentioned for Tenmast or HAB. Reviewed Aug 15, 2026
Unsplit “Secure/encrypted environment” with no in-transit versus at-rest split, no cipher, no key management (hosting) Reviewed Aug 15, 2026
“At its sole discretion” “MCS will utilize encryption … as MCS, at its sole discretion, deems reasonably appropriate” (login terms) Reviewed Aug 15, 2026
Published SSL in transit; 256-bit at rest for SSN, alien ID, bank numbers (privacy policy) Reviewed Aug 15, 2026 How we can claim this →
Transit only SSL published; at-rest encryption not mentioned (privacy policy) Reviewed Aug 15, 2026
Both stated, blog The security page states SSL for data transmission and the company security blog states "Data encryption at rest and in transit." Security blog Reviewed Aug 15, 2026
Website SSL only The privacy policy describes SSL secure servers for the website; it does not state encryption both in transit and at rest for the product. Privacy policy Reviewed Aug 15, 2026
SSL for transmissions The privacy policy describes SSL for transmitted personal information; no at-rest statement is published. Privacy policy Reviewed Aug 15, 2026
No public claim located Affordable housing page Reviewed Aug 15, 2026
"Modern encryption" unspecified HDS describes modern encryption and access-control technologies without stating both in transit and at rest. Products Reviewed Aug 15, 2026
Attestations & track record
Product-scoped, dated third-party attestation
Read the scope line, not the badge. This is where the market is weakest.
Underway — not claimed We hold no SOC 2 attestation today and we will not imply one. Readiness work is in progress; we will publish the auditor, the audit period and the scope when it exists. Reviewed Aug 15, 2026 How we can claim this →
Undated, on request “SOC1” and “SOC2” documents available on request with no type, period or date published (Yardi TOMs); public pages cite “annual SSAE” reports instead. CSA STAR entry is a Level 1 self-assessment (CSA registry). Reviewed Aug 15, 2026
Scoped to another product ISO 27001 is scoped to MRI OnLocation, not the PHA products (MRI blog); the MRI Cloud claim is data-center-level (brochure). SOC 2 not claimed for the PHA products. Reviewed Aug 15, 2026
Yes — strongest in the set SOC 2 Type 2, announced February 14, 2025, scoped to PHA data in Elite on Azure (Emphasys release). No audit period or auditor name published. Reviewed Aug 15, 2026 How we can claim this →
No public claim located Privacy policy Reviewed Aug 15, 2026
Attests the building SOC 1 Type 1, SOC 2 Type 2 and ISO 27001 are stated for the colocation facility, undated — not the application (privacy policy) Reviewed Aug 15, 2026
No public claim located Privacy & security Reviewed Aug 15, 2026
SOC 2 Type II, annual Dated July 19, 2022: "Neighborly Software is SOC 2 Type II certified" and the announcement states it is maintained through yearly third-party audits. SOC 2 announcement Reviewed Aug 15, 2026
SOC 2 Type 1, undated Kanso publishes SOC 2 Type 1 compliance for Security and Availability, but no report date or auditor is published. FAQ Reviewed Aug 15, 2026
No public claim located Software overview Reviewed Aug 15, 2026
ISO 27001, other entities Published ISO 27001 certificates cover other CGI legal entities and regions, not the U.S. housing products. ISO certificate Reviewed Aug 15, 2026
No public claim located Products Reviewed Aug 15, 2026
FedRAMP Authorized for HUD
Not required of PHA vendors — which is exactly why the language around it should be exact.
Not claimed No HUD rule requires it of a PHA software vendor and we do not assert it. We would rather be accurate than adjacent. Reviewed Aug 15, 2026 How we can claim this →
Not on the authorization list Absent from HUD's FedRAMP Marketplace authorizations; the only FedRAMP reference is a self-statement inside a HUD P260 user guide Reviewed Aug 15, 2026
No public claim located FedRAMP Marketplace Reviewed Aug 15, 2026
“FedRAMP Capable” A marketing phrase, not a FedRAMP status. Emphasys is not listed among HUD's Marketplace authorizations (hosting page) Reviewed Aug 15, 2026
No public claim located FedRAMP Marketplace Reviewed Aug 15, 2026
No public claim located FedRAMP Marketplace Reviewed Aug 15, 2026
No public claim located FedRAMP Marketplace Reviewed Aug 15, 2026
Published, but scoped elsewhere (Azure hosting, not the product) "Our platform is hosted on Microsoft Azure's FedRAMP certified data centers" is a hosting-provider statement, not a product authorization. Security page Reviewed Aug 15, 2026
No public claim located FAQ Reviewed Aug 15, 2026
No public claim located Software overview Reviewed Aug 15, 2026
Momentum only, remediation CGI's FedRAMP package is for Momentum Enterprise Suite, not housing products, and is listed In Remediation. FedRAMP listing Reviewed Aug 15, 2026
No public claim located Products Reviewed Aug 15, 2026
Published EIV / Privacy Act safeguard statement for its own platform
HUD assigns the EIV duty to the PHA. If your vendor never states its side, you cannot inherit it.
Yes — this page The band above states our EIV training-enforcement, need-to-know and Privacy Act posture in writing, with the HUD citation behind each one, and it is a public URL you can attach to a procurement file. Reviewed Aug 15, 2026 How we can claim this →
No public claim located P260 guide addresses MFA only — P260 guide Reviewed Aug 15, 2026
No public claim located Public housing software Reviewed Aug 15, 2026
No public claim located “All of HUD's required forms” only — Elite HCV Reviewed Aug 15, 2026
No public claim located Privacy policy Reviewed Aug 15, 2026
No public claim located Privacy policy Reviewed Aug 15, 2026
For owners, not PHAs Paid model EIV policy, expressly excluded from Public Housing, HCV and PBV (NMA shop) Reviewed Aug 15, 2026
No public claim located Privacy & consent policy Reviewed Aug 15, 2026
No public claim located Privacy policy Reviewed Aug 15, 2026
"HUD compliant" only SACS calls its package "HUD compliant," not an EIV or Privacy Act safeguard statement. Software overview Reviewed Aug 15, 2026
No public claim located Affordable housing page Reviewed Aug 15, 2026
No public claim located Products Reviewed Aug 15, 2026
Trust center a procurement officer can actually read
Eight of eleven vendors reviewed have no security page at all.
Yes Controls, mandates and citations published on this page, with our attestation gaps named rather than omitted. Reviewed Aug 15, 2026 How we can claim this →
Security pages, no trust center Cloud security Reviewed Aug 15, 2026
Regional page only MRI AU security page; none found for HAPPY, Tenmast, HAB or Lindsey Reviewed Aug 15, 2026
Hosting page Hosting Reviewed Aug 15, 2026
No public claim located Login terms Reviewed Aug 15, 2026
No public claim located Privacy policy Reviewed Aug 15, 2026
No public claim located Privacy & security Reviewed Aug 15, 2026
Public security page A readable, public security page exists. Security page Reviewed Aug 15, 2026
FAQ answer, no page Security is addressed in one FAQ answer; no dedicated trust center or security page is published. FAQ Reviewed Aug 15, 2026
No public claim located Privacy policy Reviewed Aug 15, 2026
No public claim located Affordable housing page Reviewed Aug 15, 2026
No public claim located Products Reviewed Aug 15, 2026
Adverse public record on cybersecurity
Reported, not alleged by us.
None No reported security incident. Reviewed Aug 15, 2026 How we can claim this →
Customer-side, via the product A landlord's compromised email account was used to reach the landlord portal inside New Hampshire Housing's Yardi RentCafe environment (~July 2, 2026), reported to the NH Attorney General July 30, 2026 (case file) Reviewed Aug 15, 2026
No public claim located None found in the registry reviewed — California AG breach list Reviewed Aug 15, 2026
Vendor states recurring PHA fallout “Several times a year, we help PHAs recover from the fallout of an attack” (Emphasys). Houston Housing Authority said of its 2024 ransomware, “we strongly believe that they were not able to steal our Elite database” (Government Technology) Reviewed Aug 15, 2026
No public claim located Breach notification “without undue delay” committed (privacy policy) Reviewed Aug 15, 2026
No public claim located Publishes a fraud notice Reviewed Aug 15, 2026
$3.7M False Claims Act settlement DOJ announced June 17, 2024 that Nan McKay settled allegations of failing to perform required cybersecurity testing before New York's ERAP portal went live; the portal was shut down within 12 hours after applicant PII was exposed (DOJ) Reviewed Aug 15, 2026
No public claim located California AG breach list Reviewed Aug 15, 2026
No public claim located California AG breach list Reviewed Aug 15, 2026
No public claim located California AG breach list Reviewed Aug 15, 2026
GAO breach; PII suit Reuters: the GAO said CGI Federal reported a breach affecting "approximately 6,000 current and former employees of the GAO," notified January 17, caused by "an actor exploiting vulnerability in externally provided" software, with names, Social Security numbers, addresses and "certain banking details" exposed. Separately, in McDowell v. CGI Federal Inc., Civ. Action No. 15-1157 (D.D.C., decided June 1, 2017), plaintiffs alleged CGI employees "stole personally identifiable information ('PII') CGI obtained pursuant to a contract with the U.S. Department of State"; the court dismissed all claims except a third-party-beneficiary contract theory and "the parties settled the case… on September 20, 2017." Reuters · JD Supra Reviewed Aug 15, 2026
No public claim located California AG breach list Reviewed Aug 15, 2026
Data & compliance currency
Public per-field data provenance page
Yes Public per-field data provenance page shows the origin and transformation path for each published field. Reviewed Aug 15, 2026 How we can claim this →
No public claim located Voyager PHA Reviewed Aug 15, 2026
No public claim located Public housing software Reviewed Aug 15, 2026
No public claim located Elite HCV Reviewed Aug 15, 2026
No public claim located Software overview Reviewed Aug 15, 2026
No public claim located Privacy policy Reviewed Aug 15, 2026
No public claim located Privacy & security Reviewed Aug 15, 2026
No public claim located Security page Reviewed Aug 15, 2026
No public claim located FAQ Reviewed Aug 15, 2026
No public claim located Software overview Reviewed Aug 15, 2026
No public claim located Affordable housing page Reviewed Aug 15, 2026
No public claim located Products Reviewed Aug 15, 2026
Published comp methodology + nationwide building-level dataset
Yes Sources and the estimate page publish the methodology and nationwide building-level dataset. Reviewed Aug 15, 2026 How we can claim this →
No public claim located Voyager PHA Reviewed Aug 15, 2026
No public claim located Public housing software Reviewed Aug 15, 2026
No public claim located Elite HCV Reviewed Aug 15, 2026
No public claim located Software overview Reviewed Aug 15, 2026
No public claim located Privacy policy Reviewed Aug 15, 2026
No public claim located Privacy & security Reviewed Aug 15, 2026
No public claim located Security page Reviewed Aug 15, 2026
No public claim located FAQ Reviewed Aug 15, 2026
No public claim located Software overview Reviewed Aug 15, 2026
No public claim located Affordable housing page Reviewed Aug 15, 2026
No public claim located Products Reviewed Aug 15, 2026
Dated HUD mandate tracker with weekly regulation watch
Yes The dated HUD mandate tracker is supported by a weekly regulation watch; compliance details are public. Reviewed Aug 15, 2026 How we can claim this →
No public claim located Voyager PHA Reviewed Aug 15, 2026
No public claim located Public housing software Reviewed Aug 15, 2026
No public claim located Elite HCV Reviewed Aug 15, 2026
No public claim located Software overview Reviewed Aug 15, 2026
No public claim located Privacy policy Reviewed Aug 15, 2026
No public claim located Privacy & security Reviewed Aug 15, 2026
No public claim located Security page Reviewed Aug 15, 2026
No public claim located FAQ Reviewed Aug 15, 2026
No public claim located Software overview Reviewed Aug 15, 2026
No public claim located Affordable housing page Reviewed Aug 15, 2026
No public claim located Products Reviewed Aug 15, 2026

RentSpire cells marked ◊ (self-disclosure) are our own assertions, not third-party verified. The attestation and FedRAMP rows are explicitly marked "not claimed" — we do not imply certifications we have not earned. Hover any cell for the specific evidence basis.

Ask us for the evidence, not the adjective — sales@rentspire.com

§

Methodology & HUD Regulations

Every determination follows federal rent reasonableness law. Citations link to the governing authority.

Data, provenance & field coverage moved. Per-field fill rates, the two provenance lineages, gap remediation, ontology coverage, the source-document register and the HOTMA roadmap note are now on the Data & Provenance page → They read the same live views; none of it is cached or restated here.
⚠

Disclaimers

Read before relying on any output from this workspace.
  • This workspace produces decision-support output, not a final rent reasonableness certification. A PHA reviewer must confirm every determination.
  • Comparables are real unassisted market listings from your state register (community name, city, rent, sqft, source URL, photo). Where a comparability factor has no structured data (e.g. amenities, quality tier, year built), it is disclosed as "not available — no adjustment applied" — never fabricated.
  • The PHA reviewer retains sole responsibility for the rent reasonableness decision under 24 CFR 982.507.
  • Comparables and methodology are retained for audit and included in the exported PDF determination.
  • Nothing here is legal advice. Consult your agency's counsel and adopted policies.
  • Headline numbers vs. the data page: the gate counters (e.g. “Usable market-rate comps”) read from mv_rr_apartment_headline, which counts in-pool apartment comparables. The Data & Provenance page reads from v_prov_kpi_rollup, which counts all rows in rr_comparables including excluded and property-record rows. These are different predicates — the numbers will differ, and both are correct for what they measure.
RentSpire · PHA Solutions

Compliance, comparables and casework for public housing authorities. Live measured data, honest claims, cited methodology — nothing on this site is estimated.

sales@rentspire.com

Solutions

Sign In to Your Portal Browse an Authority Tenancy Approval Pipeline Module Directory Planning Estimate Landlord RFTA Submission Find My Housing Authority

Tools & Demos

HOTMA Income & Assets Embedded HUD BI Grants & NOFA Radar Payment Standards Rent Reasonableness Demo All Nine Stations

Methodology & HUD

Methodology & Regulations Vendor Comparison Data & Provenance Source Status Compliance Register Control Evidence

Trust & Legal

Disclaimers Straight Answers Privacy Terms Accessibility Do Not Sell or Share
© 2026 RentSpire · PHA Solutions. All rights reserved. Decision-support software. The PHA reviewer retains sole responsibility for every determination under 24 CFR 982.507.

Talk to sales

This composes an email in your own mail app — nothing is sent or stored from this page.

or email sales@rentspire.com directly
RentSpirePHA PORTAL
Loading authority…
Onboard
Owners Vendors
Operate
Dashboard Caseload AVAILABLE Obligation Calendar AVAILABLE RFTA Intake AVAILABLE
⊞All steps — overview 01RFTA Intake (HUD-52517) AVAILABLE 02Owner Onboarding & W-9 AVAILABLE 03Lease & Tenancy Addendum (52641-A) AVAILABLE 04Rent Reasonableness (24 CFR 982.507) AVAILABLE 05NSPIRE / HQS Inspection AVAILABLE 06HOTMA Income & Assets (102/104) AVAILABLE 07Payment Standards & SAFMR AVAILABLE 08HAP Contract & File (HUD-52641) AVAILABLE 09HUD-50058 / PIC Submission AVAILABLE
AI Support Agent PILOT Capital Needs Assessment (CNA / PNA) PLANNED Community Operations PILOT Embedded HUD BI AVAILABLE Grants & NOFA Radar AVAILABLE HOTMA Income & Asset Verification AVAILABLE Housing Locator & Owner Engagement AVAILABLE Inspection OS (NSPIRE / HQS) AVAILABLE Payment Standard Studio (SAFMR) AVAILABLE PerilMark — Owner & Community Insurance PLANNED Rent Reasonableness Pro AVAILABLE Rent Studies & Advisory PLANNED
Compliance
Mandate & Compliance Register AVAILABLE
Administer
Roles & Permissions AVAILABLE
Forms & Files
Forms Library HAP File Assembly (HUD-52641) AVAILABLE HUD-50058 Pre-Check AVAILABLE
Data
Data & Provenance Source Status
Your plan
Modules & Pricing
—
Your authority
HCV program
Switch authority / sign out

Dashboard

REAL-TIME DATA · CASE TRACKING

Check if a rent is reasonable

Live comps for your state. A signed HUD determination out the other side.

Start a rent check →

Today at your authority

What needs a person, pulled live from your case register.
Checking your queue…
—
Rent comparables in your state
Real advertised apartment rents a determination can draw from.
—
ZIP areas with apartment coverage
ZIPs where 3+ apartment communities are mapped. Some are records still awaiting a rent.
—
Addresses you can look up
Type any of these into search and get the community’s record.
—
Authorities in your state
Every PHA in the live HUD directory, including yours.
—
Open cases at your authority AVAILABLE
Household files your team is working right now.

Next obligations

The nearest dated deadlines — funding, comment windows, mandates, HAP clocks.Open the full calendar →
Fetching dated obligations…

Your market, measured

Live numbers from the same comparable pool a determination draws from.

What apartments ask in right now

Loading…

How asking rents are moving

Loading…

Where your open cases stand

Loading…

Resident Tenancy Steps 01–09

Nine steps, one case.See all steps →
01RFTA Intake (HUD‑52517)AVAILABLE 02Owner Onboarding & W‑9AVAILABLE 03Lease & Tenancy Addendum (52641‑A)AVAILABLE 04Rent Reasonableness (24 CFR 982.507)AVAILABLE 05NSPIRE / HQS InspectionAVAILABLE 06HOTMA Income & Assets (102/104)AVAILABLE 07Payment Standards & SAFMRAVAILABLE 08HAP Contract & File (HUD‑52641)AVAILABLE 09HUD‑50058 / PIC SubmissionAVAILABLE

Module status — development, launch, production

Every module on the platform and exactly where it stands.Pricing →
Loading the module register…

Quick tools

Which authority serves an address?AVAILABLEOpen → Pull a community recordAVAILABLEOpen →

Tools marked AVAILABLE run on the production register — the same comps, standards and addresses the workspace uses. Case tracking is live: household files are database rows shared by your authority. Open your caseload →

Everything with a date on it

Fetching…

Red = under 14 days. Amber = under 45. (month) marks a mandate whose register deadline names a month, not a day — shown on the 1st, never invented more precisely than HUD wrote it. Local HAP clocks appear when you sign in.

Fetching every dated obligation…
Station 1 starts with the owner — packets land here, not in a fax tray

Owners submit the Request for Tenancy Approval (HUD-52517) online at the owner RFTA intake. Every packet gets a reference number and a private tracking link. Your queue shows what arrived, what is missing and how old each packet is; flag missing items and the owner cures them from their link — a full two-way loop with every touch recorded. Accepting a packet opens the household case file and starts Resident Tenancy Steps 01–09.

Reading or deciding packets requires a signed-in account with the Resident file permission and two-factor verified — the database itself refuses everything else.

—
Awaiting review
—
Out for cure with owner
—
Accepted → case opened
—
Not approved
Owner intake page ↗

Loading the queue…

Household case files live in the database, not in a browser tab

One case file per family, unit and lease-up event, shared by your whole authority: park a file while you wait on an owner, work twenty others at the same time, and pick any of them back up exactly where they stood — from any desk. Each file carries all nine Resident Tenancy Steps, who did what and when, and the 60-day HAP clock (24 CFR 982.305(c)).

Reading or writing case files requires a signed-in account with the Resident file permission and two-factor verified — the database itself refuses everything else, and every change is recorded.

—
Open cases
—
Waiting on someone
—
Follow-ups due
—
HAP clocks under 14 days

Loading your caseload…

01RFTA Intake (HUD‑52517)Is the packet complete? Starts the 15-day clock.AVAILABLEOpen →
02Owner verification & W-9Can we pay this owner?AVAILABLEOpen →
03Unit eligibility & leaseRight unit, lawful lease.AVAILABLEDetails →
04Rent Reasonableness (24 CFR 982.507)Real comps, 24 CFR 982.507 math, HUD-52517 out.AVAILABLEOpen workspace →
05HQS / NSPIRE inspectionPass before payment.AVAILABLEDetails →
06HOTMA Income & AssetsVerified income, correct TTP.AVAILABLEDetails →
07Payment Standards & SAFMRSAFMR by ZIP, every bedroom size.AVAILABLEOpen →
08HAP contract & file assemblyNine artifacts, 60-day clock.AVAILABLEOpen →
0950058 pre-submissionCatch rejections before PIC does.AVAILABLEOpen →

A case is born when an RFTA lands at Station 1 and ends with an accepted 50058 at Station 9. How the pipeline works, station by station →

What this is. The portal's permission system is enforced in the database, not in the browser: every table in the portal schema is deny-by-default (RLS), every role-permission grant below is a row in the enforcement tables, and every sensitive action lands in a hash-chained, append-only audit log that is anchored daily and cannot be edited or deleted — attempts to alter it are rejected by the database itself.

This matrix is read live from the same tables the database enforces — it is not a mock-up. Per-user sign-in is live: each staff member signs in with their own account, and the role on that account gates the navigation for real. Directors and admins also manage their own team below, from this page.

—
PHA roles
—
Permissions
—
Grants in the live matrix
—
PII-tiered permissions
Segregation of duties — built into the matrix
  • Admin administers, never adjudicates. The admin role cannot conduct hearings, approve rent reasonableness, or disburse money.
  • The director approves. Money movement, RR approvals and role grants require director-level access.
  • Hearing officers are independent. They read case files but hold no write access to the casework they review.
  • Specialists write their own caseload only — scoped by program and caseload, time-boxed, revocable.
Your team AVAILABLE

Visible only to signed-in directors and admins of this authority. Activations, grants and revocations below execute in the database under the same rules as everything else — a self-grant is refused, only an admin can grant admin, the last director or admin of an authority can never be removed, and every action lands on the hash-chained audit log.

Loading your team…

Two-factor authentication AVAILABLE

A free authenticator app on your phone (Google Authenticator, Microsoft Authenticator, 1Password…) shows a 6-digit code that changes every 30 seconds. Once you turn this on, a password alone is not enough: the database itself refuses to release any of your permissions until the code is verified — this is not a cosmetic prompt in the browser.

Preview navigation as a role ROLLOUT PREVIEW

Database enforcement is live today, and per-user sign-in is live in its first increment. Pick a role to preview which areas of this portal that role will see. This preview changes nothing and grants nothing.

The live matrix — every grant, straight from the enforcement tables
approvewriteread— none PII tier 0–3

Loading the live matrix…

Rollout — where permissions go from here
  1. Phase 1 — enforcement spine AVAILABLE Role matrix, deny-by-default RLS, hash-chained audit log with daily anchor, break-glass with mandatory reason and auto-audit, PII tier registry (tier 3 is rejected from shared schemas by trigger).
  2. Phase 2 — per-user sign-in AVAILABLE Staff sign-in with real accounts is live: sign-ups provision inactive, zero-role accounts; activation and every sign-in land on the audit chain; the signed-in role gates the left navigation; and the EIV/UAAF attestation gate withholds EIV-dependent permissions in the database until the HUD-52676 form and current annual training are recorded. Still in build inside this phase: TOTP MFA enrollment.
  3. Phase 3 — delegated administration FIRST INCREMENT AVAILABLE Directors and admins activate accounts, grant and revoke roles from this page — optionally time-boxed, always audit-chained, with lockout protection (an authority can never lose its last director or admin). Still in build: caseload-level scoping, quarterly access recertification with one-click evidence export.
  4. Phase 4 — field & partner access PLANNED Inspector and owner-facing scopes, read-only auditor sessions for HUD reviews, and export packets an authority can hand to its IG.
Inspection scheduling & captureNSPIRE checklists, deficiencies, re-inspection clocks.PILOT
HUD-52580 inspection checklistThe official HQS form, ready to print.HUD.GOVPDF →
Remote video inspectionsPIH 2026-18 — what HUD now allows.HUD.GOVPDF →
What Station 5 will doDetails →
1Verify the owner & unitOwnership, units, history — on the community register.AVAILABLEScreen an owner →
2Collect the W-9Required before any HAP payment.IRS.GOVForm →
3Lead-paint disclosurePre-1978 units: the EPA pamphlet families must receive.EPA.GOVPamphlet →
4Sign the HAP contractHUD-52641 with the 52641-A tenancy addendum.HUD.GOVContract →
5Direct deposit setupBank verification and first-payment tracking.PILOT

Five steps from "interested owner" to "paid on time." Owner records stay internal — names and personal emails are never published.

1Collect the W-9Inspectors, contractors, abatement crews.IRS.GOVForm →
2Exclusion checkConfirm the vendor is not federally debarred.SAM.GOVCheck →
3Insurance certificateCOI upload and expiry tracking.PILOT
4Contract & scopeWork orders tied to inspection deficiencies.PILOT

Vendor files live with the case they serve — a deficiency at Station 5 becomes a work order here.

FormWhat it isUsed at
HUD-52517Request for Tenancy ApprovalSTATION 1PDF →
HUD-52646VoucherBRIEFINGPDF →
HUD-9886-AConsent to release information (current edition 10/23; replaces the pre-2024 consent form)INTAKEPDF →
HUD-52675Debts owed to PHAsINTAKEPDF →
HUD-5380VAWA notice of rightsINTAKEPDF →
HUD-5382VAWA certificationINTAKEPDF →
HUD-52580Inspection checklist (HQS)STATION 5PDF →
HUD-52667Utility allowance scheduleSTATION 7PDF →
HUD-52641HAP contractSTATION 8PDF →
HUD-52641-ATenancy addendumSTATION 8PDF →
HUD-50058Family reportSTATION 9PDF →
IRS W-9Taxpayer identificationOWNERS · VENDORSPDF →
EPAProtect Your Family From LeadOWNERSPDF →

Official sources only — every link goes to hud.gov, irs.gov or epa.gov and was verified working on Aug 8, 2026. Pre-filled forms from your case data ship with the tenancy spine.

Rent Reasonableness Core STATION 4
The determination engine: real comps, 24 CFR 982.507 math, HUD-52517 output, audit trail.
Request your sized quote →
Intake & File Assembly A LA CARTE
Stations 1, 2, 8, 9 — RFTA completeness, owner screening, HAP file, 50058 pre-check.
Request your sized quote →
Search & Standards AVAILABLE
À la carte — housing search for families, payment standards by ZIP, community lookup, jurisdiction finder.
Request your sized quote →
Full Pipeline ALL-IN-ONE
Every station and module, one contract — inspections and HOTMA included as they ship.
Request your sized quote →

Every module, a la carte

All 11 solutions in the catalog, A to Z — each links to its scope brief.
Capital Needs Assessment (CNA / PNA) PLANNED
Capital and physical needs assessments on the same community spine. Scope →
Request your sized quote →
Community Operations PILOT
Leasing, repairs and day-to-day work on the same community data. Scope →
Request your sized quote →
Embedded HUD BI AVAILABLE
Your authority's HUD reporting, embedded where the work happens. Scope →
Request your sized quote →
Grants & NOFA Radar AVAILABLE
Funding notices matched to your programs before deadlines pass. Open the demo →
Request your sized quote →
HOTMA Income & Asset Verification AVAILABLE
Station 6 — HOTMA-rule income and asset workflows. Open the demo →
Request your sized quote →
Housing Locator & Owner Engagement AVAILABLE
Locator, owner portal and incentives — scoped from 18 real solicitations. Open the demo →
Request your sized quote →
Inspection OS (NSPIRE / HQS) AVAILABLE
Station 5 — offline-first NSPIRE and HQS inspections. Scope →
Request your sized quote →
Payment Standard Studio (SAFMR) AVAILABLE
Station 7 — SAFMR-aware payment standard modelling by ZIP. Open the demo →
Request your sized quote →
PerilMark — Owner & Community Insurance PLANNED
Insurance and peril risk intelligence on the portfolio you already track here. Scope →
Request your sized quote →
Rent Reasonableness Pro AVAILABLE
Station 4 — the determination engine this portal is built around. Open →
Request your sized quote →
Rent Studies & Advisory PLANNED
Commissioned studies and advisory on the same measured data. Scope →
Request your sized quote →

Quotes are sized to your authority — per voucher under ACC, not one-size-fits-all. Add modules a la carte as caseload needs them, or take the full pipeline. No dollar figures are published until your quote.