Security at ReBillion
ReBillion is the AI-native transaction coordinator with the security posture brokerages actually need. The AI control plane for real estate must clear broker-of-record IT review; we built for that bar.
Security is non-optional in a brokerage-grade AI TC. Below is our posture: encryption, access, audit, vendor management, incident response.
Encryption
At rest. AES-256-GCM across the records vault, contract artifacts, and the deal database. Key management via cloud KMS with per-tenant key separation on Enterprise.
In transit. TLS 1.3 minimum. HSTS preload enabled on rebillion.ai.
Access control
Role-based access at firm, office, team, and individual level. SSO via SAML 2.0 and OIDC on Enterprise. MFA required for all admin roles.
Audit logging
Immutable per-deal audit log. Every record-write captures user, timestamp, action, before/after. Logs export in CSV or via API.
Sub-processors
We maintain a current sub-processor list (cloud infrastructure, AI inference, transactional email, SMS, payments). Published at /legal/sub-processors and updated within 30 days of any change.
Incident response
24/7 on-call. Disclosure within 72 hours of confirmed material incident to affected customers. Quarterly tabletop exercises.
Vulnerability management
Dependency scanning on every commit. Penetration testing annually by an independent firm. Responsible disclosure via /contact.
Where to read more
Frequently asked
Are you SOC 2 Type II certified?
Pre-audit. Target date and current state on /security/soc2.
Do you support customer-managed keys?
Yes on Enterprise.
What's the data residency?
U.S. default; EU residency on Enterprise.
Do you offer a penetration-test report?
Yes under NDA. Reach out via /contact.
Is MFA required?
Yes for admin roles; optional and recommended for all users. Enterprise can enforce firm-wide.
Are sub-processors disclosed?
Yes. The current list is published at /legal/sub-processors and updated within 30 days of any change, with advance notice available for enterprise customers.
See the AI control plane on your real files.
30-minute live demo with the founders. No sandbox; we run on your contracts.