Security
Your data is yours, and we treat it that way.
This page is the practical version of what's in our privacy policy. No marketing, no certifications-theatre. Just a clear explanation of what we protect, how we protect it, and what we'd do if something went wrong.
Encryption + data handling
In transit, at rest, and in memory.
TLS 1.3 everywhere
All traffic — customer-facing sites, admin panels, APIs, webhooks — is served over TLS 1.3 with HSTS preload. Certificates renew automatically through Cloudflare, rotated every 90 days.
AES-256 at rest
Postgres is encrypted at rest on managed Supabase infrastructure. R2 object storage (listing images, media uploads) uses server-side AES-256. Backups inherit the same encryption.
Secrets stay out of code
API keys, DB credentials, and service tokens live in encrypted secret stores on our platforms — Cloudflare Workers secrets and Supabase configuration. Nothing sensitive is ever written to logs, error payloads, or Git history.
Password hashing
User passwords are hashed with a one-way algorithm (Supabase Auth’s bcrypt defaults). We never see a plaintext password — not in logs, not in support tickets, not in backups.
Data residency
Where your data lives — stated plainly.
We'd rather tell you exactly where your data is than imply something that isn't true yet. Encrypted in transit and at rest, on SOC 2-certified infrastructure providers, handled under PIPEDA-aligned practices.
Primary database
Managed Postgres (Supabase, SOC 2 Type II-certified) in AWS us-east-1 today — encrypted at rest, handled under Canadian privacy law (PIPEDA) wherever it sits, point-in-time recovery, service-scoped least-privilege access. Canadian-region hosting is on our public roadmap; this page changes the day it does.
Object storage
Cloudflare R2 with global edge caching. Listing photos mirrored from MLS® boards are retained only as long as board display rules allow for the surfaces they support — active listings publicly, sold and off-market imagery solely for the gated VOW surfaces — and purged on a scheduled cycle after that.
AI processing
Where the product uses AI models, inference runs on Anthropic infrastructure under commercial API terms that exclude training on your content — your leads, messages, and listings are never used to train any model.
Transactional email via Resend, sent from mail.brokerfold.com so our reputation is isolated from your own Workspace domain.
Authentication
Least-privilege by default.
Multi-factor auth
Rate-limited sign-in, verified email on every account, and short-lived rotating session tokens. TOTP-based MFA is in active development — this page changes the day it ships.
Session hygiene
Sessions expire on inactivity and JWTs rotate on every refresh. Signing out invalidates the session server-side.
Role-based access
Team and Brokerage plans get granular roles — owner, admin, agent, assistant — each with scoped permissions on contacts, listings, billing, and settings.
SSO (SAML / OIDC)
On the roadmap for the Brokerage tier — bring your own IdP (Okta, Entra, Google Workspace, or any SAML 2.0 provider) when it lands. Timeline on the roadmap page.
Resilience
When something goes wrong — and it will — we plan for it.
Continuous backups
Point-in-time recovery on Postgres with a 7-day window, plus scheduled encrypted exports to an immutable, write-once (WORM) vault held in a separate account. RPO target is 1 minute; RTO target is 1 hour.
Uptime
99.95% target on the tenant edge, measured on a quarterly rolling window. A public status page with incident history is on the roadmap — until it ships, incident notices go to affected customers directly.
Incident response
Any incident affecting customer data, availability, or integrity triggers a written post-mortem within 5 business days, shared with affected customers.
Compliance posture
Honest about where we are.
We're building toward the certifications that matter for Canadian real estate. Here's the plain truth about today and the next 18 months.
PIPEDA + CASL aligned
BrokerFold is built to meet PIPEDA obligations for personal information and CASL rules for electronic communications. A full privacy statement is in the privacy policy.
MLS data handling
We honour the data-use terms of every board we connect to — no public scraping, no data resale, and no retention or display beyond what each board’s rules allow.
SOC 2 Type I
Controls are being implemented now; we target a Type I audit late 2026. Type II to follow once we have a year of evidence.
ISO 27001
Scoped as the next certification after SOC 2 Type II. Not a near-term commitment, but on the radar for enterprise brokerage customers.
Responsible disclosure
Found something? Tell us — we'll thank you for it.
If you've identified a vulnerability in BrokerFold, please email support@brokerfold.com with as much detail as you can share — repro steps, affected endpoints, a proof of concept if safe. We'll acknowledge within one business day and work the issue with you until it's resolved.
- We don't threaten legal action against good-faith researchers.
- We credit reporters publicly (if you want) in the incident post-mortem.
- We don't run a bug bounty today, but we send real thank-you notes — and our most serious reports get a meaningful reward.
Questions we haven't answered here?
Security reviews, vendor questionnaires, DPA requests — send them our way and we'll turn them around within a week.
support@brokerfold.com →