PayHOA review: the whole price is published, and the whole app is a browser

Who it is for

PayHOA is built for the association that has decided to run itself, and it is unusually honest about what that costs. The subscription is billed to the association rather than per door until you pass 500 units, the bands are printed, and the fee card beside them prices the things that actually drive an HOA’s bill — a mailed letter, a mailed cheque, an incoming ACH, an incoming card payment, a tax filing. See the pricing rows in the fact box above. A board treasurer can build a twelve-month budget line for this product from a public page in about ten minutes, which is not something most of this category allows.

It suits a second profile too, and the pricing page says so plainly: management companies, who are moved off the band table onto a per-unit rate with a monthly minimum. That is a different product decision than the one the self-managed bands describe, and a company evaluating it should read the per-unit line rather than the bands.

It does not suit a board whose owners expect to do this on a phone. There is no PayHOA app on either store — not a broken link, an absence, and we checked again on the evaluation date. Everything a homeowner does happens in a browser. For a community whose demographic already lives in a resident app, that is the finding that will decide it, and no amount of accounting depth compensates. Nor does it suit a board that needs a vendor’s security questionnaire answered with a certificate: the controls are real and documented, but the paperwork a cautious management company or an insurer asks for does not exist publicly.

What we evaluated, and how

This review rests entirely on published documentation read on 14 September 2026. No hands-on session was run and no demo account was requested, which is why ease of use is not scored. Every URL was hash-checked against a deliberately invalid path on the same host before it was treated as real, because this site returns a styled page for paths that do not exist.

That check matters more here than usual. PayHOA’s conventional security and support paths — /security, /support, /help, /docs, /status, /changelog — are all byte-identical to the invalid-path control. A sweep that probed only those would have reported a vendor with no security posture and no support documentation. Both exist: the security and support pages sit under a feature path that is discoverable only through the sitemap, and the substantive material is in a hosted knowledge base on a different domain entirely. The contract is at /terms-conditions/, not /terms-of-service/, and /trust returns a 200 only because it redirects to an unrelated blog post.

The knowledge base is where the evidence actually is, and it is where the scores above are drawn from: 202 admin articles, 28 homeowner articles, 94 videos and 7 release-note posts on the evaluation date. Where a claim appears only in marketing copy, this review attributes it to the vendor rather than stating it as verified.

One reading correction worth recording, because it would be easy to get wrong in the vendor’s favour: the only SOC 2 reference anywhere in PayHOA’s public material describes its payment processor’s compliance, not its own. PayHOA is not represented here as SOC 2 audited, and it does not represent itself that way either.

Core functionality

The knowledge base documents the category job at the level of individual screens. Invoicing covers recurring and one-time charges, starting balances and locally collected payments. Requests come in three default forms — architectural, maintenance and general — each with its own read and edit permissions, its own notification routing, custom statuses and approval workflows, and the ability to be disabled entirely if a board does not want owners filing them. Violations carry private admin-only notes and an email log. Documents share to a unit, to specific units, or publicly. Amenity scheduling is a full module with booking rules, cool-down spacing, per-day limits, required agreements and an approval queue.

The honest gap is in payables. The module takes vendor invoices by email into an inbox, routes them through approval rules and pays them, but for a generally available account it pays by printed or mailed cheque only; the help centre states that ACH and virtual-card payments to vendors are on the roadmap. The exception is the Financial Account beta described below, whose accounts can send vendor payments by ACH. An association outside the beta paying a dozen vendors a month is mailing a dozen cheques, with USPS time on top of the scheduled date.

Accounting and financial controls

This is the strongest part of the product, and the documentation is specific enough to check. Reconciliation is a real workflow rather than a checkbox: enter or upload the statement, work the transaction list down to a zero difference, and finish, which produces a reconciliation report the help centre explicitly suggests handing to board members, homeowners or auditors. Bank feeds come through Plaid-supported accounts or a direct integration with one named bank. Reserve funds have their own set of articles covering setup as either an equity or a liability account, transfers in, and how those transfers appear on budget-versus-actual. Returned payments create a reversing transaction, which the documentation says preserves the audit trail. Reports export to CSV and PDF throughout, and a bookkeeping service and tax filings can be bought at published rates.

Two things keep this at four rather than five. The first is that the reconciliation article itself warns that deleting a previously reconciled transaction adjusts the balance sheet and general ledger — the ledger is editable after close, and the control against that is the permission model rather than the software. The second is that no general activity log is documented anywhere: there is a communication log for messages sent, and an audit trail on specific payment events, but nothing that answers “who changed this figure, and when” across the system.

A treasurer should also note that a separate financial account — funds held at a named bank through the processor’s treasury product, with commercial spend cards — is documented as being in beta and not available to every account.

Resident experience

A homeowner gets a portal, not an app. Inside it: online payment by ACH or card, message boards, surveys and votes, shared documents, amenity booking and request submission. Two-factor authentication is available to homeowners as well as administrators, by authenticator app or SMS, with trusted devices — which is more than several competitors offer residents at all. There is a nice touch for the owners who will never log in: emailed statements carry a single-use, expiring token link that opens the account without anyone sharing a password.

None of that changes the headline. Every other product in this category that targets residents ships a phone app, and PayHOA does not. An App Store search for the vendor name returns no PayHOA title, and three plausible Play package names all return 404. That has been true across three separate verification sweeps now, most recently on the evaluation date, so it should be read as a product decision rather than an oversight.

Security, permissions and data ownership

Judged on what is actually published, PayHOA’s posture is better than its security page suggests and weaker than a cautious buyer will want. The help-centre article carries the substance: infrastructure entirely within AWS behind a private network, per-user JWT signing secrets rather than one shared secret, input validation against the usual injection and cross-site classes, quarterly PCI scans, four-hourly incremental backups with a nightly full across multiple zones, and the fact that no bank or card data is stored on PayHOA’s servers at all because the processor tokenises it. Payments route from payor to target account without touching a PayHOA bank account. Two-factor authentication and per-module read/edit permissions are documented with step-by-step articles.

The contract adds the one commitment that carries legal weight — PCI DSS certification as a service provider — and confirms that the subscriber owns its user data, that data is preserved for thirty days after cancellation and made available on request, and that the subscriber can leave at any time.

What is missing is the assurance layer. There is no SOC 2 or ISO certification of PayHOA’s own, no list of subprocessors, no data processing agreement, no data-residency statement and no breach-notification commitment; the privacy policy is a consumer website policy that describes recipients only as contractors, service providers and payment processors. There is no status page and no SLA — the terms disclaim liability for downtime outright and reserve the right to modify or discontinue the service without notice. A board should also read the termination clause before it commits: PayHOA reserves the right to terminate an account or delete its content at any time, without warning, at its sole discretion, and liability is capped at the greater of twenty dollars or two months of fees.

Pricing and contract terms

The pricing posture is the best in this category and the fact box carries the numbers. What belongs here is what the price page does not say. Fees are non-refundable in all directions, including the unused remainder of a prepaid year if you cancel mid-term — cancellation is free, but the money already paid stays paid. After the trial the subscription runs a one-month term and auto-renews monthly unless cancelled, which is a month-to-month commitment rather than the annual lock common elsewhere in this category, but it is still an auto-renewal. PayHOA may revise the terms at any time by updating a date at the top of the page, with the customer expressly waiving any right to specific notice. Disputes go to individual arbitration with a class-action waiver. Sales tax is added in states where the vendor has crossed the threshold.

Alternatives worth a look

If you are choosing between published-price products for a self-managed association, the head-to-head with the other one is PayHOA vs EasyHOA. If your association is a condo building where the resident-facing side and the front desk matter more than the ledger, PayHOA vs Condo Control is the relevant comparison, and it is also the place where PayHOA’s missing app is weighed against a competitor that has one.

Corrections

27 September 2026. This review said PayHOA pays vendors by cheque only. That holds for generally available accounts — the Payables article still reads “Today, Payables supports check payments only. ACH and virtual-card payments to vendors are on the roadmap.” — but it was too absolute: a help-centre article last updated 19 July 2026 documents “Starting an ACH Payment from the Payables Module” for accounts in the Financial Account beta, which it says “is currently in beta and is not yet available to all accounts.” The core-functionality basis note, the corresponding con and the payables paragraph have been reworded. No score changed.