Security & compliance
Multi-tenant does not have to mean shared visibility
A white-label platform carries other people's customers, listings, rental applications, documents, and money. These are the controls that make that trade acceptable, the rules each module enforces, and the parts a tenant is still responsible for.
Commitments
8 things that constrain how the platform is built
Tenant isolation by construction
Row-level tenancy on every query, with the tenant scope resolved from the session, never from a client-supplied identifier. Cross-tenant reads are impossible by design, not by convention.
SOC 2 aligned controls
Access reviews, change management, encryption in transit and at rest, key rotation, and immutable audit logging. The security brief maps every control to evidence.
Fair Housing guardrails
Filter vocabulary, ad-copy review queues, and a human-approval gate on generated listing descriptions. Protected-class targeting is not offered anywhere in the product, and the Equal Housing statement is fixed on every storefront.
Rental screening through an FCRA-compliant CRA
Screening is ordered only through a consumer reporting agency with recorded written consent, and a denial cannot be finalized without an adverse action notice. Screening criteria are published before the application and exclude protected characteristics.
Nothing of yours is in our custody
Rent, deposits, and earnest money are held and moved only by licensed payment and escrow partners. We hold no funds as a principal and take no percentage of a sale.
Lending data handled as nonpublic personal information
Documents gathered in a lending flow are field-encrypted, scoped to the deal, and excluded from analytics and export pipelines, in line with GLBA-appropriate handling.
The marketplace owner keeps data ownership
The tenant owns its listing, rental, lead, provider, and transaction data. We take a license limited to operating and supporting the platform, support export at any time, and never resell tenant-identifiable data.
Money handled explicitly
Every fee is computed from a published rule — a flat software fee, a subscription, or a flat technology fee — applied to a closed deal or a signed lease and written to an auditable ledger.
Compliance by module
10 modules carry a regulated activity, and each one names the licensed party
Buy & sell
Licensed actor: The tenant's brokerage and its licensed agentsA buyer working with an agent signs a written buyer representation agreement — with its compensation terms stated — before touring or submitting an offer.
The offer and tour flows cannot proceed for an agent-represented buyer until the agreement is attached to the contact record.
Buyer-broker compensation offers must not be displayed from MLS-sourced listing data.
Compensation fields are stripped on ingest from MLS feeds, so they cannot be rendered on the storefront even by configuration.
IDX display follows each MLS's own rules and attribution requirements.
Field-level display rules and required attribution are configured per MLS feed and applied at render time.
Real estate compensation moves only between licensed parties.
The split engine blocks any payout to a user without a verified license on file.
Aurum Estate's own fee is a software fee billed to the tenant, never a share of a commission or a percentage drawn from the closing.
The billing engine only knows flat per-deal and subscription line items; there is no sale-price percentage field to set.
Off-market & pre-marketing
Licensed actor: The MLS participant holding the listingA listing held by an MLS participant that is marketed off-MLS is filed with the MLS as an office exclusive or the local pre-marketing status first.
The off-market publish step requires an MLS filing reference before the listing can be exposed to any gated audience.
The seller signs a disclosure acknowledging what is given up by delaying public marketing.
A signed seller disclosure is a required attachment on the off-market listing record.
Once the listing is publicly marketed, it must be submitted to the MLS within one business day.
Turning on public marketing starts the one-business-day clock and blocks further gated distribution until the MLS submission is logged.
Gated exposure limits are configurable per MLS, because broad gated exposure may itself count as public marketing.
Viewer caps, qualification tiers, and audience scope are per-MLS settings, and the UI states that broad gated exposure may trigger the filing clock.
Wholesale & assignments
Licensed actor: The wholesaler, subject to their state's rulesWholesaling is regulated differently in each state — some require a license, some require specific disclosures, some have no special rule.
A per-state rule set gates publishing: an assignment deal cannot go live until the state's requirement is satisfied.
Where required, the buyer must be told that the wholesaler holds an equitable interest rather than title.
The required disclosure is attached to the deal and shown in the gated detail view in states that mandate it.
Wholesale assignment fees are tracked, not collected, by the platform.
The assignment fee field writes to the deal record for reporting and is excluded from every payout run.
Several states, including Illinois, Oklahoma, and Pennsylvania, regulate wholesaling activity.
Those states ship with the license-required or disclosure-required rule pre-set rather than defaulting to no rule.
Rentals & leasing
Licensed actor: The landlord or property manager, with a licensed payment partner for fundsScreening runs only through an FCRA-compliant consumer reporting agency, with the applicant's written consent.
Screening cannot be ordered without a recorded consent event, and consent is stored with the application.
A denied applicant receives an adverse action notice with the CRA's contact details and dispute rights.
Declining an application opens an adverse action workflow and will not close without the notice on file.
Screening criteria are published before the applicant applies, and the criteria fields exclude protected characteristics.
Criteria are set at the listing level and the field vocabulary is constrained; source-of-income options respect states and cities that protect it.
Total move-in cost is disclosed up front, and application fee caps, refund rules, banned fees, and deposit limits vary by jurisdiction.
A per-jurisdiction fee ruleset governs caps, refunds, banned fees, deposit limits, and deposit return deadlines.
Any fee passed to a renter must be configurable per jurisdiction and switchable off.
Renter-paid fees are off by default and must be enabled per jurisdiction, because some states and cities ban renter processing and junk fees.
Lending & pre-qualification
Licensed actor: The lender or mortgage broker; never Aurum Estate or an unlicensed tenantThe platform does not originate, broker, arrange, negotiate, or recommend a specific loan.
There is no rate-quoting or product-recommendation surface; pre-qualification begins only when the consumer asks for it.
Consumers see a lender directory and choose their own lender — not a matching engine that ranks or routes them.
The directory sorts on filters the consumer sets, with no platform-side ranking or lead routing.
Lenders may not pay per lead, per application, or per closed loan.
Lender plan types are limited to flat subscription and flat advertising at fair market value.
Each lender's NMLS ID is displayed on its profile and anywhere its name appears.
NMLS ID is a required field on the lender profile and renders with the profile in every context.
Affordability calculators are estimates, not credit decisions or offers of credit.
Affordability output carries its own label and is separated from any lender-provided pre-qualification result.
Service provider network
Licensed actor: Each provider, verified for the license it holdsNo payment to or from Aurum Estate or a tenant for the referral of settlement services.
Settlement-service categories (title, escrow, lenders, appraisers, settlement agents) can only be assigned flat-fee plan types in the admin dashboard. Per-lead, per-referral, per-order, and per-closed-loan plan types are not selectable for them.
Advertising to settlement-service providers is a flat fee at fair market value for a real placement.
Placements are sold as fixed-duration or fixed-slot flat fees, and every paid placement renders a "Sponsored" label.
Consumers are always shown other options and may choose a provider outside the marketplace.
Sponsored placements never suppress the directory, and provider sections state that the consumer may choose any provider.
Where a tenant owns or co-owns a title, escrow, or mortgage business, the consumer sees an Affiliated Business Arrangement disclosure.
Affiliated business relationships are declared on the tenant record and trigger the disclosure in the consumer flow.
Licenses are verified and displayed where they exist.
State real estate license, NMLS ID, title/escrow license, and appraiser license are verified before a provider can act and are shown on the profile.
Payments & money handling
Licensed actor: A licensed payment and escrow partnerRent, deposits, and earnest money are held and moved only by a licensed payment or escrow partner.
Money movement is delegated to the payment partner's rails; Aurum Estate never holds or transmits funds as a principal.
Earnest money handling and disbursement follow the governing state's escrow rules.
The disclosure packet and funding checklist for each state name the licensed party that holds the deposit.
Any platform fee earned from a payment partner is disclosed.
Partner economics on the payment rail are listed in the revenue rules with the party that pays them.
Privacy & communications
Licensed actor: The tenant, as the data controller for its consumersSMS and autodialed calls require prior express written consent, captured separately and never pre-ticked.
Consent is a separate unchecked box with its own disclosure text, and the consent record is retained with its timestamp and source.
Opt-outs are honored, and quiet hours are enforced on outbound messaging.
The notification engine suppresses sends inside configured quiet hours and stops immediately on an opt-out keyword.
Email marketing follows CAN-SPAM, with a working unsubscribe and a postal address in every send.
Campaign sends require the sender identity and unsubscribe block, which cannot be removed per tenant.
State privacy laws, including the CCPA/CPRA, carry access and deletion rights.
Data-subject requests are handled from the support console with an auditable fulfillment trail.
Financial information gathered in lending flows is treated as nonpublic personal information.
Lending documents are field-encrypted, access-scoped to the deal, and excluded from analytics exports.
Fair Housing & advertising
Licensed actor: The tenant, whose advertising it isSearch filters, listing copy, and generated text exclude protected characteristics.
Filter vocabulary is constrained at the schema level, and AI-generated copy cannot publish without human approval.
Every tenant storefront displays the Equal Housing Opportunity statement.
The statement is a fixed platform element, rendered per storefront and not removable by configuration.
Ad targeting tools must not target or exclude by protected class.
Boost and campaign targeting offers geography, price, and property facts only — never demographic or protected-class audiences.
Advertising across the platform is reviewed for discriminatory language.
Listing copy passes a review queue, and flagged phrases block publishing until they are revised.
Accessibility
Licensed actor: Aurum Estate, for the platform; the tenant, for its contentStorefronts and the admin dashboard target WCAG 2.1 AA.
Keyboard operability, visible focus, semantic headings, and contrast are treated as acceptance criteria for every surface, including the demos on this site.
Uploaded media requires alternative text before it can publish.
The media library requires alt text on upload and blocks publishing without it.
Guardrails
The things the platform refuses to let you skip
- A listing cannot publish until the tenant's license verification clears
- Disclosure packets cannot be skipped, only configured per state
- MLS-sourced compensation fields never render on a storefront
- Generated listing copy always passes a human approval gate before publishing
- Screening cannot be ordered without recorded FCRA consent
- A denied rental applicant cannot be closed out without an adverse action notice
- Settlement-service providers cannot be billed per lead, per order, or per loan
- Sponsored placements are always labeled, and the consumer can choose any provider
- The Equal Housing Opportunity statement cannot be removed from a storefront
- Tenant scope is resolved from the session, never from a request parameter
Per jurisdiction
Rules that vary by state, MLS, or city are configuration
| Rule | How the platform handles it | Where it is set |
|---|---|---|
| Application fee caps | The dashboard caps what a landlord may charge an applicant and enforces any required refund when no unit is taken. | Set per city and per state |
| Rental application fees are capped in some cities | Cities such as Ann Arbor cap the application fee. The cap is a jurisdiction rule rather than a platform default. | Ann Arbor, MI is the shipped example |
| Renter processing and junk fees are banned in some states | Where renter-paid fees are restricted, the fee switch must be off. Some restrictions phase in, so the effective date matters. | Colorado, from 2026 is the shipped example |
| Security deposit limits and return deadlines | Deposit maximums and the deadline to return a deposit vary widely. Both are jurisdictional settings on the lease template. | Configured per state |
| Wholesaling licensing and disclosures | A state may require a license, require a disclosure that the wholesaler holds equitable interest, or impose no special rule. | Illinois, Oklahoma, and Pennsylvania are the shipped examples |
| Pre-marketing and office-exclusive filing | The filing status, the seller disclosure, and the one-business-day submission clock are configured per MLS, since exposure limits differ. | Set per MLS |
| Source-of-income protection | Where a state or city protects a lawful source of income, the screening criteria cannot exclude it, and the option is removed from the vocabulary. | Configured per state and city |
Framework coverage
What we handle, and what stays yours
Tenant data isolation
Core design constraintEvery query is tenant-scoped from the session. Cross-tenant reads are structurally impossible, and isolation has integration coverage rather than relying on developer discipline.
Your responsibility
Grant the right roles to the right people. The platform enforces scope, but a tenant still decides who is an admin.
Rental screening and adverse action
Enforced in workflowScreening runs only through an FCRA-compliant consumer reporting agency with recorded written consent. A denial opens an adverse action workflow that will not close without the notice on file, and screening criteria are published before the application.
Your responsibility
Set criteria that comply in each market you operate in, exclude protected characteristics, and respect source-of-income protections where they apply.
Fair Housing
Constrained by schemaSearch filter vocabulary is limited to compliant options, generated listing copy passes a human approval gate before publishing, and no ad-targeting tool offers a protected-class audience. The Equal Housing statement is a fixed storefront element.
Your responsibility
Review published copy and advertising, and train agents on advertising rules in your markets.
TRID disclosure timing
Enforced in workflowDisclosure packet assembly and delivery timing are part of the transaction state machine. A deal cannot advance past a disclosure gate that has not cleared.
Your responsibility
Confirm the disclosure set and timing rules for each state you operate in with your own counsel.
MLS, NAR, and pre-marketing
Per-feed and per-MLSIngestion runs under the tenant's own data license with per-MLS display rules enforced at the field level. Off-market exposure requires the office-exclusive or pre-marketing filing, a signed seller disclosure, and MLS submission within one business day once the listing is publicly marketed. Compensation fields are stripped on ingest.
Your responsibility
Maintain your MLS participation, and set the disclosure limits for each MLS — broad gated exposure may itself count as public marketing.
RESPA and provider fees
Restricted by plan typeSettlement-service categories can only be assigned flat-fee plan types. Per-lead, per-referral, per-order, per-application, and per-closed-loan pricing is not selectable for title, escrow, lenders, appraisers, or settlement agents. Sponsored placements are labeled and never suppress the directory.
Your responsibility
Declare any ownership interest in a settlement business so the Affiliated Business Arrangement disclosure triggers in the consumer flow.
Wholesaling by state
Blocked until satisfiedA per-state rule set — license required, disclosure required, or no special rule — gates publishing an assignment deal. Where required, the disclosure that the wholesaler holds an equitable interest rather than title is attached before it goes live.
Your responsibility
Confirm your state's treatment of wholesale activity with your own counsel before listing an assignment.
Lending data and originator conduct
Scoped and labeledThe platform does not originate, broker, arrange, negotiate, or recommend a loan. Pre-qualification is consumer-initiated, lenders are listed in a directory rather than ranked or matched, NMLS IDs are displayed, and affordability output is labeled as an estimate.
Your responsibility
If any part of your operation is separately licensed for mortgage activity, keep that activity in the licensed entity and off the marketplace surface.
Money handling
Never in our custodyRent, deposits, and earnest money are held and moved only by licensed payment and escrow partners. We hold no funds as a principal, and any platform fee earned from a payment partner is disclosed.
Your responsibility
Work with the licensed partner in each state, and confirm the deposit and disbursement rules that apply to your transactions.
Privacy and communications
Consent captured in-flowTCPA consent for SMS and autodialed calls is a separate, unchecked box with its own disclosure and a retained consent record. Quiet hours are enforced, opt-outs stop sends immediately, and CAN-SPAM requirements are fixed in every campaign send.
Your responsibility
Only contact people who consented, and handle data-subject access and deletion requests that route to you as the controller.
ESIGN / UETA
Consent captured in-flowElectronic signature consent, envelope creation, and signature certificates are recorded and archived with the transaction or lease so the audit trail survives.
Your responsibility
Keep your document templates current and jurisdictionally valid.
State licensing
Verified at onboardingEntity licensing and insurance are verified during onboarding and can be re-verified on a schedule, because operating in a new state is an onboarding event rather than a settings change. Agents, lenders, and providers are license-verified before they can act.
Your responsibility
Hold and maintain the licenses you operate under, and notify us when coverage changes.
Accessibility
Acceptance criteriaStorefronts and the admin dashboard target WCAG 2.1 AA: keyboard operability, visible focus, semantic headings, contrast, and alt text that a media item cannot publish without.
Your responsibility
Keep your own content accessible, including listing media and copy.
Data ownership
The tenant owns the data. We operate it.
- Tenants own their listing, rental, lead, provider, and transaction data.
- We take a narrow license limited to operating and supporting the platform.
- Full structured export is available on request in documented formats.
- Tenant-identifiable data is never resold or shared with another tenant.
- Aggregate analytics, if ever offered, are built only from opt-in tenants and never expose a single tenant's figures.
- Deletion is honored at the tenant level and confirmed in writing.
- Consumer data-subject requests are handled with an auditable fulfillment trail, and the tenant is the controller.
Procurement
What we can hand to your reviewer
- Security overview briefAvailable on request
- SOC 2 aligned control mappingAvailable under NDA
- Data Processing AddendumPublished
- Subprocessor listAvailable on request
- Penetration test summaryAvailable under NDA
- Business continuity and DR planAvailable under NDA
- Compliance-by-module rule setPublished on this page
On certifications: we publish our real posture
Aurum Estate operates SOC 2 aligned controls and can map them to evidence under NDA. We do not claim a completed SOC 2 Type II report, ISO certification, or PCI attestation that we have not actually finished. If your procurement process requires one of those, tell us early — we will say plainly whether the timing works, rather than putting a badge on this page.
Operations
When something goes wrong
Detection and triage
Alerting on authentication anomalies, unusual export volume, and privilege changes, with a defined severity ladder and an on-call owner for each level.
Containment and notification
Documented containment steps, including credential rotation and tenant-level isolation if required, with contractual notification windows for affected tenants.
Review
Every incident produces a written review with corrective actions tracked to completion. Affected tenants receive the findings, including ours.
Posture
What the platform is, and what it is not
- Aurum Estate is software and infrastructure. We are not a brokerage, we do not act as a real estate broker, and we do not market properties on our own behalf.
- We are not a lender, mortgage broker, or loan originator, and we do not originate, broker, arrange, or recommend any loan.
- We do not hold or transmit funds as a principal. Rent, deposits, and earnest money are handled only by licensed payment and escrow partners.
- The platform helps tenants operate compliantly and enforces the rules they configure. It does not make anyone compliant and does not guarantee compliance.
- Rules vary by state, MLS, and city, and they change. Partners are responsible for review by their own counsel before launching.
Review with us
Send your security questionnaire before the demo
We would rather answer your reviewer's questions in week one than discover them in week ten. Send the questionnaire, your DPA redlines, or your data residency requirements and we will respond in writing.