Security & Trust

Real estate transactions involve sensitive financial and personal data. Here's how we protect it.

Encryption

256-bit SSL/TLS — All data in transit is encrypted using industry-standard TLS 1.3 encryption.
Password hashing — Passwords are hashed using bcrypt with a cost factor of 12. We never store plain-text passwords.
Database encryption — All data at rest is encrypted via our hosting provider's infrastructure-level encryption.

Authentication & Verification

Two-factor authentication (2FA) — Sensitive actions like offer submission require a verification code sent to your email or phone.
Email verification — All accounts must verify their email address before submitting offers.
Session management — Sessions are automatically expired after inactivity, with warnings before timeout.
Rate limiting — Login attempts, password resets, and API calls are rate-limited to prevent abuse.

Data Protection

We collect only the information necessary to facilitate real estate offers. Your data is never sold to third parties.

Minimal data collection — We only store what's needed for the offer process.
No third-party data sales — Your personal and financial information is never sold.
Account deletion — You can request complete account deletion at any time.
CCPA compliant — California residents have full data rights as outlined in our privacy policy.

For full details, see our Privacy Policy.

Compliance

ESIGN Act

Digital signatures on Aletheia comply with the federal Electronic Signatures in Global and National Commerce Act.

UETA

We comply with the Uniform Electronic Transactions Act adopted by Utah and most US states.

Important: Aletheia is not a licensed real estate broker. We provide a technology platform for offer submission and do not provide legal or real estate advice. Users should consult licensed professionals.

Audit Trail

Every action on Aletheia is logged with a tamper-resistant audit trail, providing a complete record of the offer process.

Timestamped actions — Every offer submission, counter, acceptance, and rejection is logged with precise timestamps.
IP and device tracking — We record the IP address and user agent for each significant action.
Digital signature hashes — Signatures are cryptographically hashed (SHA-256) with the signed document data, timestamp, and user ID.
Immutable records — Audit log entries cannot be modified or deleted.

Have security questions or want to report a vulnerability?