Security & trust
You are sending usyour executed leases.
Practices
How your data is handled
Encryption
Everything you send is encrypted in transit with TLS 1.2 or better, and encrypted at rest. Lease documents are stored in object storage with server-side encryption and are never served from a public bucket.
Access control
Single sign-on via your identity provider, role-based permissions, and least-privilege internal access. Engineer access to customer data requires a named business reason and is logged.
Tenancy separation
Each customer's leases, sales figures and findings are logically isolated. Your gross sales are used to price your remedies and nothing else — they never contribute to another customer's output.
Audit trail
Every abstraction, every occupancy observation and every evaluation is versioned with its source and timestamp. You can reconstruct what we believed on any past date, which is what makes a claim defensible.
Retention and deletion
You set the retention period. On termination we delete customer data and documents within 30 days, and confirm it in writing. Backups age out on a documented schedule.
Availability
Hosted on major cloud infrastructure in US regions, with automated backups and point-in-time recovery. Breakpoint is a monitoring layer — an outage delays a notification, it never alters your lease record.
Compliance
Where we actually are — not where we’d like to be
Plenty of early companies imply certifications they don’t hold. Since our entire product is about being auditable, that would be a strange place to start.
SOC 2 Type II
Not yet held. We are building against the criteria and will publish the report when the observation window completes. We will not describe ourselves as certified before that is true.
In progressPenetration testing
Independent testing before general availability, then annually, with a summary letter available to customers under NDA.
PlannedSubprocessors
A current list of subprocessors — cloud hosting, document storage, model providers and error monitoring — is available on request and maintained as a contractual commitment.
On requestModel handling
Lease text is processed for abstraction only. We do not permit customer documents to be used to train third-party models, and this is contracted with our providers.
ContractedSecurity review before you send anything?
Send your questionnaire and we’ll complete it. If your team would rather start with a redacted lease while diligence runs, that works perfectly well — the clause language is what we need, not your counterparty names.