Security and compliance at CREpublic.
CREpublic holds sponsors’ confidential offering material and the account details of the members who review it. It is built not to hold identity documents, bank details or investor funds. This page summarises how that data is protected and where our compliance program stands. Firms conducting vendor due diligence can request the full Security Overview.
- Personal data
- No identity documents, tax IDs or bank details
- By design
- Hosting
- Supabase and Vercel, both SOC 2 Type II, US regions
- In place
- Encryption
- TLS in transit, AES-256 at rest
- In place
- Access control
- Row-level security on every table
- In place
- Records
- Append-only messaging with a sealed audit chain
- In place
- Staff access
- Two-factor on every account, hardware keys where supported
- In place
- Change control
- Protected main branch, tests and review on every change
- In place
- Our SOC 2
- Type I examination in preparation
- In progress
The controls in operation.
CREpublic holds members’ contact and professional details, self-certified accreditation, indication amounts and deal activity. It does not hold or move investor funds, and it does not collect identity documents or bank details. The controls below protect the data it does hold. Each is described in full in the Security Overview.
- Infrastructure
- Hosted on Supabase and Vercel, both SOC 2 Type II, with all data in US regions, encrypted in transit and at rest. The database is backed up daily and files are copied hourly to versioned storage.
- Access control
- Row-level security on every table, so each request returns only what the requesting user is authorised to see.
- Authentication
- Members: twelve-character minimum, breached-password screening, Google and Microsoft sign-in, rate limiting on sensitive endpoints. Staff: two-factor on every production account, hardware security keys wherever the vendor supports them, encrypted devices and a quarterly access review.
- Audit trail
- File access, membership, deal and administrative actions are logged and available to a firm’s administrators.
- Monitoring and incident response
- Continuous error and availability monitoring. A confirmed security incident affecting a firm’s data is notified to that firm without undue delay, with the facts known at the time and a named contact.
- Change management
- Every change to the platform reaches production through a pull request, automated tests, secret scanning, a dependency audit and a recorded review.
Supervision, records and policy control.
A registered adviser or broker-dealer that places employees on CREpublic must supervise what they communicate, retain it as a business record and apply the firm’s own policies. The platform was built to that standard.
- In-platform communications are retained as a business record: append-only, revisioned, and recorded in a tamper-evident, cryptographically chained audit log whose daily seal is kept in write-once storage.
- A firm’s administrators and compliance contacts can review the firm’s activity log and produce an integrity-attested export of its communications, scoped by deal or date range.
- Membership, edit rights, the required identity provider, AI processing and NDA terms are configured by the firm from its own settings.
The record design, export contents and the firm-facing roadmap are set out in sections 7 to 9 of the Security Overview.
AI saves members time. Firms decide whether their people use it.
AI reads a sponsor’s own offering documents into the deal form, so a deal is launched by reviewing fields rather than retyping them, and it generates cover imagery from a property type and a location. It makes no decision about any deal, sponsor or investor.
A firm can turn off the platform’s AI features for all of its members from its settings. Where it is on, documents are processed under vendor terms that prohibit training on them, principally inside CREpublic’s own AWS account.
A Type I examination is in preparation.
Our hosting providers hold SOC 2 Type II reports covering their infrastructure. CREpublic is preparing for a SOC 2 Type I examination of the application itself, scoped to Security, Confidentiality and Availability. The current status, including scheduled work, is stated in the Security Overview.
The full document, on request.
The Security Overview is a dated, versioned description of the platform’s controls, written for a firm’s vendor review. Requests from a named person at a firm are answered within two business days. The detailed edition is provided under confidentiality terms.
Request the Security OverviewContents
- 01System description and data map
- 02Controls by SOC 2 criterion: Security, Confidentiality, Availability
- 03Communications records, supervision and export mechanics
- 04Firm-configurable policies
- 05AI processing, vendor terms and retention
- 06Incident response and breach-notification commitments
- 07Sub-processors and their security certifications
- 08Program status and roadmap
Third parties that process personal data.
We track each vendor’s security certifications. This list is updated when a vendor is added, removed or changes purpose.
| Vendor | Purpose | Region |
|---|---|---|
| Supabase | Database, authentication, file storage | US |
| Vercel | Website and application hosting; website visit statistics | US |
| Amazon Web Services | File backup, AI processing (Bedrock), audit-record seals | US |
| Anthropic, via Amazon Bedrock | Reading offering and company documents into structured fields | US |
| Anthropic (direct) | The same, when Bedrock is unavailable | US |
| OpenAI | Generating cover images from a property type and location | US |
| Anthropic (Claude, consumer plan) | Staff research, engineering and support | US |
| Google, Microsoft | Optional sign-in | US |
| Resend | Transactional and offering emails | US |
| Brevo | Newsletter subscriptions and sending | EU |
| Apollo.io | Business contact data for outreach to professionals | US |
| Brandfetch | Company logos | Switzerland, hosted on AWS |
| Sentry | Error and availability monitoring | US |
| Upstash | Rate limiting | US |
| Mapbox | Maps | US |
| Doppler | Secrets management | US |
Last updated October 2026.
Reporting a security issue.
Suspected vulnerabilities should be reported to security@crepublic.com. We acknowledge reports within two business days and ask researchers not to access other members’ data or disrupt the service. The same contact is published at /.well-known/security.txt.
Questions on security or compliance.
Security questions are answered in writing by the people who operate the platform, with reference to the specific control concerned.