Trust & Security
Security at CRE OneSource
Our customers trust us with the information that runs their brokerage — their deals, their clients, and their commissions. We take that seriously. This page describes the practices we follow to keep that information secure, available, and private.
Last modified: September 2026.
Organizational Security
Information Security Program
We maintain a written information security program that is shared across the company and reviewed periodically. Our program is aligned with the criteria of the SOC 2 framework, an information security auditing standard developed by the American Institute of Certified Public Accountants.
Third-Party Assessment
We engage an independent third party to assess our security and compliance controls.
Security Testing
We test the security of our application through code review, automated checks in our build pipeline, and periodic security testing of our production environment.
Roles and Responsibilities
Responsibility for our security program and for the protection of customer data is documented and assigned. Team members review and accept our security policies.
Security Awareness Training
Team members complete security awareness training covering common risks such as phishing, social engineering, and password hygiene.
Confidentiality
Team members and contractors agree to confidentiality obligations covering customer and company information.
Background Checks
We perform background checks on new team members where permitted by applicable law.
Infrastructure and Data Security
Hosting
Our application and databases are hosted on Render, a managed cloud platform that runs on top of major cloud infrastructure providers and maintains its own security program and third-party certifications. We also use Google Cloud Platform for document storage and analytics. Details of our providers’ security practices are available at Render Security and Google Cloud Security.
Data Location
Customer data is stored in managed databases and cloud storage located in the United States.
Encryption at Rest
Databases, backups, and stored documents are encrypted at rest by our infrastructure providers.
Encryption in Transit
Traffic between our applications, our customers, and our service providers is encrypted in transit using TLS.
Separation of Environments
Our production environment is kept separate from our development and testing environments, and access to production is restricted.
Vulnerability Management
We monitor our software dependencies and infrastructure for known vulnerabilities and apply updates and patches on a risk-prioritized basis.
Logging and Monitoring
We log application and infrastructure activity and use error monitoring and alerting tools to detect failures and unexpected behavior in our services.
Backups and Recovery
We rely on our hosting provider’s managed backup and point-in-time recovery capabilities to reduce the risk of data loss from hardware or platform failure, and we maintain a documented approach for restoring service.
Incident Response
We maintain a process for responding to security events that covers escalation, investigation, mitigation, and communication, including notifying affected customers where required.
Access Security
Authentication in the Product
CRE OneSource supports single sign-on with Google and Microsoft accounts, as well as multi-factor authentication. Passwords are never stored in plain text; they are stored using a strong one-way hashing algorithm.
Role-Based Permissions
Customer administrators control what each of their users can see and do through role and permission settings in the application.
Least Privilege
Internally, access to production systems, cloud infrastructure, and other sensitive tools is limited to team members who need it for their role.
Access Reviews
We review access to sensitive systems periodically, and we remove access promptly when a team member changes roles or leaves the company.
Internal Account Security
Our team is required to use strong, unique credentials, to enable multi-factor authentication on company accounts where it is available, and to use a password manager for storing credentials.
Artificial Intelligence Features
Some CRE OneSource features use large language models from established AI providers to read documents and draft suggestions for our users. We send only the data needed to perform the requested task, we use these providers under commercial terms that do not permit customer data to be used to train their models, and suggestions generated by these features are reviewed and confirmed by a person before they are saved.
Vendor and Risk Management
Risk Assessments
We perform a risk assessment at least annually to identify threats to our business and our customers’ data, including considerations for fraud.
Vendor Review
We review the security posture of vendors that process customer data before authorizing their use, and we re-evaluate them as our use of them changes.
Privacy
We collect and use customer data only to provide and improve the CRE OneSource service. We do not sell customer data. Our handling of personal information is described in our Privacy Policy.
Contact Us
If you have questions about this page, would like more detail about our security practices, or wish to report a potential security issue, please contact us at security@creonesource.com. We will acknowledge reports of suspected vulnerabilities and work with the reporter to understand and address them.
Ready to simplify, level up, and grow?
See CRE OneSource live — from prospect to payment, with your own deals.