Security & Trust

Aletheia never holds, processes, or passes through any transaction funds. Earnest money goes directly to the title or escrow company, not through us.

No funds through Aletheia

We are a transaction platform, not a payment processor. No money ever moves through our systems.

Wire fraud check before closing

Before the sale can be marked closed in the closing room, the buyer must confirm that they verified the title company’s wire instructions by phone, using a number they looked up themselves, not one from an email. Every buyer is asked, however they pay. Aletheia never holds, transfers, or verifies wire instructions itself.

Who can see your documents

Offers, purchase agreements, and transaction documents are accessible to the buyers and sellers in that transaction, including co-buyers and co-sellers, and access is checked on the server. The one exception is an offer’s review link: anyone who has that link can read that offer’s terms.

Generated from your inputs

Purchase agreements are generated from the terms you and the other party enter. The signed document becomes part of your transaction record and cannot be modified after signing.

Encryption in transit

All data is encrypted in transit (HTTPS).

Password hashing

Passwords are hashed using bcrypt with a cost factor of 12. We never store plain-text passwords.

Database encryption

All data at rest is encrypted via our hosting provider’s infrastructure-level encryption.

Email verification

All accounts must verify their email address before submitting offers.

Identity verification

The first time you list a property or make or accept an offer, and before a co-buyer or co-seller signs, we verify your identity with a government ID and a selfie. It happens once per account, takes a couple of minutes, and runs inside the page you are already on. Our verification provider handles the documents; Aletheia never receives or stores your ID images. It keeps whether the check passed, the date, and the provider's reference number for the check. Until a check passes, your work is saved and sending waits. This does not verify property ownership. Ownership is attested by the seller under penalty of perjury and confirmed by the title company before closing.

Session expiration

An open Aletheia page signs you out after 30 minutes with no activity, with a warning 5 minutes before. Separately, a session expires 8 hours after it was last used.

Rate limiting

Login attempts, password resets, and API calls are rate-limited to prevent abuse.

Significant actions are logged as they happen, with a timestamp and the account that took them. Entries are hash-chained: each one stores a hash of the entry before it. Both parties can open a transaction’s activity feed and export it as a PDF or CSV, and the log is retained with the transaction.

Drawn signatures

Electronic signatures are captured as a drawn image paired with the signer’s IP address, timestamp, and user ID.

SHA-256 document hashes

Every signed document gets a SHA-256 fingerprint at the moment of signing. If the document were altered afterward, even by a single character, the fingerprint would no longer match. The alteration would be provable.

Timestamped actions

Every offer submission, counter, acceptance, and rejection is logged with precise timestamps. These appear in the offer’s own history, and once an offer is accepted, in the transaction’s activity feed as well.

IP and device logging

The IP address and user agent are recorded for each significant action.

Hash-chained entries

Each audit entry stores a hash of the entry before it, so entries are cryptographically linked in sequence.

Electronic signatures

Signed electronically. Utah UETA and federal E-SIGN recognize electronic signatures.

Aletheia is not a licensed real estate broker. We provide a technology platform for offer submission and do not provide legal or real estate advice. Consult a licensed professional for legal or transactional guidance specific to your situation.

No data sales

Your personal and financial information is never sold to third parties.

Account deletion

Delete your account anytime from Account Settings. Deletion anonymizes your personal information (name, email, contact details); completed transaction records are kept for six years.

Retention

Six years reflects Utah’s written contract statute of limitations (Utah Code § 78B-2-309). It is our choice of how long to keep records available for dispute resolution. No law requires it.

For full details, see our Privacy Policy.