Security

• Invitation only. There is no open sign-up. Every account starts from a single-use invitation that expires after 14 days and is tied to one email address.
• Organization assignment happens on our server. A user cannot move themselves into another organization or raise their own access level.
• Three access levels (developer, fund, program owner), stored apart from anything a user can edit.

• Row-level security in the database. Every table holding customer records enforces, inside the database itself, who may read each row. A user reads their own organization’s records. The exceptions are deliberate and narrow: a deal profile the developer has made public, a fund reading the seats shared with it, and the lender listings in the marketplace.
• Funds see shared seats only. A fund reads a developer’s program record only after that seat has been shared with it, and never sees draft plans.
• Program staff screens re-check the user’s owner access on every request and every change.

• Checklist evidence and review decisions, deal outcomes, impact counts, report submissions, lender outreach and fund positions are append-only. Database triggers refuse edits to them, for every user and for our own service account.
• Weekly capital numbers can be corrected by the developer, and every save is kept as a revision that cannot be edited.
• Each record carries when it happened, as entered, and when the platform received it, set by the server.
• Corporate and financial documents are never uploaded. We keep links and review status.

• Database and sign-in run on Supabase. The application runs on Vercel. Both are in the United States.
• All traffic uses HTTPS. The database provider encrypts stored data at rest.
• Passwords are handled by Supabase Auth and never seen or stored by our code.
• Pages are served with a strict Content Security Policy, which limits what code a page may load and run.

The application may contact only an approved list of services: Supabase, Anthropic (for Real Wisdom), Resend (for email), Slack (a weekly summary to program staff), Google Drive and Dropbox (only to fetch a linked document a reviewer asks Real Wisdom to read, never stored), Vercel and Google Fonts. Adding to that list is a reviewed change that our automated checks enforce. The Privacy Policy names each one.

• Every change goes through a pull request that runs automated checks for leaked credentials, known code weaknesses, vulnerable dependencies and unapproved outbound services, plus an independent AI code review.
• Access rules and scoring logic have their own automated tests, which must pass before those files change.
• Our working rule is to export the database before every change to its structure.

Realtor Wisdom is not yet certified under SOC 2 or ISO 27001, and sign-in does not yet offer two-factor authentication. We will say so here when either changes. If your institution needs a questionnaire completed, we will answer it.

If you believe you have found a security issue, write to anis.taylor@realtorwisdom.io. We will acknowledge it within two business days. Please do not test against other customers’ data.