Aurum Estate

Security & compliance

Multi-tenant does not have to mean shared visibility

A white-label platform carries other people's customers, listings, rental applications, documents, and money. These are the controls that make that trade acceptable, the rules each module enforces, and the parts a tenant is still responsible for.

Commitments

8 things that constrain how the platform is built

Tenant isolation by construction

Row-level tenancy on every query, with the tenant scope resolved from the session, never from a client-supplied identifier. Cross-tenant reads are impossible by design, not by convention.

SOC 2 aligned controls

Access reviews, change management, encryption in transit and at rest, key rotation, and immutable audit logging. The security brief maps every control to evidence.

Fair Housing guardrails

Filter vocabulary, ad-copy review queues, and a human-approval gate on generated listing descriptions. Protected-class targeting is not offered anywhere in the product, and the Equal Housing statement is fixed on every storefront.

Rental screening through an FCRA-compliant CRA

Screening is ordered only through a consumer reporting agency with recorded written consent, and a denial cannot be finalized without an adverse action notice. Screening criteria are published before the application and exclude protected characteristics.

Nothing of yours is in our custody

Rent, deposits, and earnest money are held and moved only by licensed payment and escrow partners. We hold no funds as a principal and take no percentage of a sale.

Lending data handled as nonpublic personal information

Documents gathered in a lending flow are field-encrypted, scoped to the deal, and excluded from analytics and export pipelines, in line with GLBA-appropriate handling.

The marketplace owner keeps data ownership

The tenant owns its listing, rental, lead, provider, and transaction data. We take a license limited to operating and supporting the platform, support export at any time, and never resell tenant-identifiable data.

Money handled explicitly

Every fee is computed from a published rule — a flat software fee, a subscription, or a flat technology fee — applied to a closed deal or a signed lease and written to an auditable ledger.

Compliance by module

10 modules carry a regulated activity, and each one names the licensed party

Software does not hold a license; a person or an entity does. Each module below names who performs the regulated act, the rules the platform enforces for it, and how that enforcement shows up in the product rather than in a policy document.

Buy & sell

Licensed actor: The tenant's brokerage and its licensed agents
  • A buyer working with an agent signs a written buyer representation agreement — with its compensation terms stated — before touring or submitting an offer.

    The offer and tour flows cannot proceed for an agent-represented buyer until the agreement is attached to the contact record.

  • Buyer-broker compensation offers must not be displayed from MLS-sourced listing data.

    Compensation fields are stripped on ingest from MLS feeds, so they cannot be rendered on the storefront even by configuration.

  • IDX display follows each MLS's own rules and attribution requirements.

    Field-level display rules and required attribution are configured per MLS feed and applied at render time.

  • Real estate compensation moves only between licensed parties.

    The split engine blocks any payout to a user without a verified license on file.

  • Aurum Estate's own fee is a software fee billed to the tenant, never a share of a commission or a percentage drawn from the closing.

    The billing engine only knows flat per-deal and subscription line items; there is no sale-price percentage field to set.

Off-market & pre-marketing

Licensed actor: The MLS participant holding the listing
  • A listing held by an MLS participant that is marketed off-MLS is filed with the MLS as an office exclusive or the local pre-marketing status first.

    The off-market publish step requires an MLS filing reference before the listing can be exposed to any gated audience.

  • The seller signs a disclosure acknowledging what is given up by delaying public marketing.

    A signed seller disclosure is a required attachment on the off-market listing record.

  • Once the listing is publicly marketed, it must be submitted to the MLS within one business day.

    Turning on public marketing starts the one-business-day clock and blocks further gated distribution until the MLS submission is logged.

  • Gated exposure limits are configurable per MLS, because broad gated exposure may itself count as public marketing.

    Viewer caps, qualification tiers, and audience scope are per-MLS settings, and the UI states that broad gated exposure may trigger the filing clock.

Wholesale & assignments

Licensed actor: The wholesaler, subject to their state's rules
  • Wholesaling is regulated differently in each state — some require a license, some require specific disclosures, some have no special rule.

    A per-state rule set gates publishing: an assignment deal cannot go live until the state's requirement is satisfied.

  • Where required, the buyer must be told that the wholesaler holds an equitable interest rather than title.

    The required disclosure is attached to the deal and shown in the gated detail view in states that mandate it.

  • Wholesale assignment fees are tracked, not collected, by the platform.

    The assignment fee field writes to the deal record for reporting and is excluded from every payout run.

  • Several states, including Illinois, Oklahoma, and Pennsylvania, regulate wholesaling activity.

    Those states ship with the license-required or disclosure-required rule pre-set rather than defaulting to no rule.

Rentals & leasing

Licensed actor: The landlord or property manager, with a licensed payment partner for funds
  • Screening runs only through an FCRA-compliant consumer reporting agency, with the applicant's written consent.

    Screening cannot be ordered without a recorded consent event, and consent is stored with the application.

  • A denied applicant receives an adverse action notice with the CRA's contact details and dispute rights.

    Declining an application opens an adverse action workflow and will not close without the notice on file.

  • Screening criteria are published before the applicant applies, and the criteria fields exclude protected characteristics.

    Criteria are set at the listing level and the field vocabulary is constrained; source-of-income options respect states and cities that protect it.

  • Total move-in cost is disclosed up front, and application fee caps, refund rules, banned fees, and deposit limits vary by jurisdiction.

    A per-jurisdiction fee ruleset governs caps, refunds, banned fees, deposit limits, and deposit return deadlines.

  • Any fee passed to a renter must be configurable per jurisdiction and switchable off.

    Renter-paid fees are off by default and must be enabled per jurisdiction, because some states and cities ban renter processing and junk fees.

Lending & pre-qualification

Licensed actor: The lender or mortgage broker; never Aurum Estate or an unlicensed tenant
  • The platform does not originate, broker, arrange, negotiate, or recommend a specific loan.

    There is no rate-quoting or product-recommendation surface; pre-qualification begins only when the consumer asks for it.

  • Consumers see a lender directory and choose their own lender — not a matching engine that ranks or routes them.

    The directory sorts on filters the consumer sets, with no platform-side ranking or lead routing.

  • Lenders may not pay per lead, per application, or per closed loan.

    Lender plan types are limited to flat subscription and flat advertising at fair market value.

  • Each lender's NMLS ID is displayed on its profile and anywhere its name appears.

    NMLS ID is a required field on the lender profile and renders with the profile in every context.

  • Affordability calculators are estimates, not credit decisions or offers of credit.

    Affordability output carries its own label and is separated from any lender-provided pre-qualification result.

Service provider network

Licensed actor: Each provider, verified for the license it holds
  • No payment to or from Aurum Estate or a tenant for the referral of settlement services.

    Settlement-service categories (title, escrow, lenders, appraisers, settlement agents) can only be assigned flat-fee plan types in the admin dashboard. Per-lead, per-referral, per-order, and per-closed-loan plan types are not selectable for them.

  • Advertising to settlement-service providers is a flat fee at fair market value for a real placement.

    Placements are sold as fixed-duration or fixed-slot flat fees, and every paid placement renders a "Sponsored" label.

  • Consumers are always shown other options and may choose a provider outside the marketplace.

    Sponsored placements never suppress the directory, and provider sections state that the consumer may choose any provider.

  • Where a tenant owns or co-owns a title, escrow, or mortgage business, the consumer sees an Affiliated Business Arrangement disclosure.

    Affiliated business relationships are declared on the tenant record and trigger the disclosure in the consumer flow.

  • Licenses are verified and displayed where they exist.

    State real estate license, NMLS ID, title/escrow license, and appraiser license are verified before a provider can act and are shown on the profile.

Payments & money handling

Licensed actor: A licensed payment and escrow partner
  • Rent, deposits, and earnest money are held and moved only by a licensed payment or escrow partner.

    Money movement is delegated to the payment partner's rails; Aurum Estate never holds or transmits funds as a principal.

  • Earnest money handling and disbursement follow the governing state's escrow rules.

    The disclosure packet and funding checklist for each state name the licensed party that holds the deposit.

  • Any platform fee earned from a payment partner is disclosed.

    Partner economics on the payment rail are listed in the revenue rules with the party that pays them.

Privacy & communications

Licensed actor: The tenant, as the data controller for its consumers
  • SMS and autodialed calls require prior express written consent, captured separately and never pre-ticked.

    Consent is a separate unchecked box with its own disclosure text, and the consent record is retained with its timestamp and source.

  • Opt-outs are honored, and quiet hours are enforced on outbound messaging.

    The notification engine suppresses sends inside configured quiet hours and stops immediately on an opt-out keyword.

  • Email marketing follows CAN-SPAM, with a working unsubscribe and a postal address in every send.

    Campaign sends require the sender identity and unsubscribe block, which cannot be removed per tenant.

  • State privacy laws, including the CCPA/CPRA, carry access and deletion rights.

    Data-subject requests are handled from the support console with an auditable fulfillment trail.

  • Financial information gathered in lending flows is treated as nonpublic personal information.

    Lending documents are field-encrypted, access-scoped to the deal, and excluded from analytics exports.

Fair Housing & advertising

Licensed actor: The tenant, whose advertising it is
  • Search filters, listing copy, and generated text exclude protected characteristics.

    Filter vocabulary is constrained at the schema level, and AI-generated copy cannot publish without human approval.

  • Every tenant storefront displays the Equal Housing Opportunity statement.

    The statement is a fixed platform element, rendered per storefront and not removable by configuration.

  • Ad targeting tools must not target or exclude by protected class.

    Boost and campaign targeting offers geography, price, and property facts only — never demographic or protected-class audiences.

  • Advertising across the platform is reviewed for discriminatory language.

    Listing copy passes a review queue, and flagged phrases block publishing until they are revised.

Accessibility

Licensed actor: Aurum Estate, for the platform; the tenant, for its content
  • Storefronts and the admin dashboard target WCAG 2.1 AA.

    Keyboard operability, visible focus, semantic headings, and contrast are treated as acceptance criteria for every surface, including the demos on this site.

  • Uploaded media requires alternative text before it can publish.

    The media library requires alt text on upload and blocks publishing without it.

Guardrails

The things the platform refuses to let you skip

Configuration is powerful, but the parts that create legal exposure are constrained by design. These are not settings, so they are not in the settings.
  • A listing cannot publish until the tenant's license verification clears
  • Disclosure packets cannot be skipped, only configured per state
  • MLS-sourced compensation fields never render on a storefront
  • Generated listing copy always passes a human approval gate before publishing
  • Screening cannot be ordered without recorded FCRA consent
  • A denied rental applicant cannot be closed out without an adverse action notice
  • Settlement-service providers cannot be billed per lead, per order, or per loan
  • Sponsored placements are always labeled, and the consumer can choose any provider
  • The Equal Housing Opportunity statement cannot be removed from a storefront
  • Tenant scope is resolved from the session, never from a request parameter

Per jurisdiction

Rules that vary by state, MLS, or city are configuration

Hard-coding one state's rule into a multi-tenant platform is how a marketplace ends up wrong in 49 of them. Each of these is a setting with a shipped example, and none of them is a substitute for your own counsel's review.
RuleHow the platform handles itWhere it is set
Application fee capsThe dashboard caps what a landlord may charge an applicant and enforces any required refund when no unit is taken.Set per city and per state
Rental application fees are capped in some citiesCities such as Ann Arbor cap the application fee. The cap is a jurisdiction rule rather than a platform default.Ann Arbor, MI is the shipped example
Renter processing and junk fees are banned in some statesWhere renter-paid fees are restricted, the fee switch must be off. Some restrictions phase in, so the effective date matters.Colorado, from 2026 is the shipped example
Security deposit limits and return deadlinesDeposit maximums and the deadline to return a deposit vary widely. Both are jurisdictional settings on the lease template.Configured per state
Wholesaling licensing and disclosuresA state may require a license, require a disclosure that the wholesaler holds equitable interest, or impose no special rule.Illinois, Oklahoma, and Pennsylvania are the shipped examples
Pre-marketing and office-exclusive filingThe filing status, the seller disclosure, and the one-business-day submission clock are configured per MLS, since exposure limits differ.Set per MLS
Source-of-income protectionWhere a state or city protects a lawful source of income, the screening criteria cannot exclude it, and the option is removed from the vocabulary.Configured per state and city

Framework coverage

What we handle, and what stays yours

A platform that claims to make a tenant compliant is selling something it cannot deliver. What follows is the honest split of responsibility, by framework.

Tenant data isolation

Core design constraint

Every query is tenant-scoped from the session. Cross-tenant reads are structurally impossible, and isolation has integration coverage rather than relying on developer discipline.

Your responsibility

Grant the right roles to the right people. The platform enforces scope, but a tenant still decides who is an admin.

Rental screening and adverse action

Enforced in workflow

Screening runs only through an FCRA-compliant consumer reporting agency with recorded written consent. A denial opens an adverse action workflow that will not close without the notice on file, and screening criteria are published before the application.

Your responsibility

Set criteria that comply in each market you operate in, exclude protected characteristics, and respect source-of-income protections where they apply.

Fair Housing

Constrained by schema

Search filter vocabulary is limited to compliant options, generated listing copy passes a human approval gate before publishing, and no ad-targeting tool offers a protected-class audience. The Equal Housing statement is a fixed storefront element.

Your responsibility

Review published copy and advertising, and train agents on advertising rules in your markets.

TRID disclosure timing

Enforced in workflow

Disclosure packet assembly and delivery timing are part of the transaction state machine. A deal cannot advance past a disclosure gate that has not cleared.

Your responsibility

Confirm the disclosure set and timing rules for each state you operate in with your own counsel.

MLS, NAR, and pre-marketing

Per-feed and per-MLS

Ingestion runs under the tenant's own data license with per-MLS display rules enforced at the field level. Off-market exposure requires the office-exclusive or pre-marketing filing, a signed seller disclosure, and MLS submission within one business day once the listing is publicly marketed. Compensation fields are stripped on ingest.

Your responsibility

Maintain your MLS participation, and set the disclosure limits for each MLS — broad gated exposure may itself count as public marketing.

RESPA and provider fees

Restricted by plan type

Settlement-service categories can only be assigned flat-fee plan types. Per-lead, per-referral, per-order, per-application, and per-closed-loan pricing is not selectable for title, escrow, lenders, appraisers, or settlement agents. Sponsored placements are labeled and never suppress the directory.

Your responsibility

Declare any ownership interest in a settlement business so the Affiliated Business Arrangement disclosure triggers in the consumer flow.

Wholesaling by state

Blocked until satisfied

A per-state rule set — license required, disclosure required, or no special rule — gates publishing an assignment deal. Where required, the disclosure that the wholesaler holds an equitable interest rather than title is attached before it goes live.

Your responsibility

Confirm your state's treatment of wholesale activity with your own counsel before listing an assignment.

Lending data and originator conduct

Scoped and labeled

The platform does not originate, broker, arrange, negotiate, or recommend a loan. Pre-qualification is consumer-initiated, lenders are listed in a directory rather than ranked or matched, NMLS IDs are displayed, and affordability output is labeled as an estimate.

Your responsibility

If any part of your operation is separately licensed for mortgage activity, keep that activity in the licensed entity and off the marketplace surface.

Money handling

Never in our custody

Rent, deposits, and earnest money are held and moved only by licensed payment and escrow partners. We hold no funds as a principal, and any platform fee earned from a payment partner is disclosed.

Your responsibility

Work with the licensed partner in each state, and confirm the deposit and disbursement rules that apply to your transactions.

Privacy and communications

Consent captured in-flow

TCPA consent for SMS and autodialed calls is a separate, unchecked box with its own disclosure and a retained consent record. Quiet hours are enforced, opt-outs stop sends immediately, and CAN-SPAM requirements are fixed in every campaign send.

Your responsibility

Only contact people who consented, and handle data-subject access and deletion requests that route to you as the controller.

ESIGN / UETA

Consent captured in-flow

Electronic signature consent, envelope creation, and signature certificates are recorded and archived with the transaction or lease so the audit trail survives.

Your responsibility

Keep your document templates current and jurisdictionally valid.

State licensing

Verified at onboarding

Entity licensing and insurance are verified during onboarding and can be re-verified on a schedule, because operating in a new state is an onboarding event rather than a settings change. Agents, lenders, and providers are license-verified before they can act.

Your responsibility

Hold and maintain the licenses you operate under, and notify us when coverage changes.

Accessibility

Acceptance criteria

Storefronts and the admin dashboard target WCAG 2.1 AA: keyboard operability, visible focus, semantic headings, contrast, and alt text that a media item cannot publish without.

Your responsibility

Keep your own content accessible, including listing media and copy.

Data ownership

The tenant owns the data. We operate it.

This is a contract term, not a support promise, because it is the first question a brokerage, MLS, or franchise asks — and it should be.
  • Tenants own their listing, rental, lead, provider, and transaction data.
  • We take a narrow license limited to operating and supporting the platform.
  • Full structured export is available on request in documented formats.
  • Tenant-identifiable data is never resold or shared with another tenant.
  • Aggregate analytics, if ever offered, are built only from opt-in tenants and never expose a single tenant's figures.
  • Deletion is honored at the tenant level and confirmed in writing.
  • Consumer data-subject requests are handled with an auditable fulfillment trail, and the tenant is the controller.

Procurement

What we can hand to your reviewer

  • Security overview briefAvailable on request
  • SOC 2 aligned control mappingAvailable under NDA
  • Data Processing AddendumPublished
  • Subprocessor listAvailable on request
  • Penetration test summaryAvailable under NDA
  • Business continuity and DR planAvailable under NDA
  • Compliance-by-module rule setPublished on this page

On certifications: we publish our real posture

Aurum Estate operates SOC 2 aligned controls and can map them to evidence under NDA. We do not claim a completed SOC 2 Type II report, ISO certification, or PCI attestation that we have not actually finished. If your procurement process requires one of those, tell us early — we will say plainly whether the timing works, rather than putting a badge on this page.

Operations

When something goes wrong

An incident response plan that has never been exercised is a document, not a capability.

Detection and triage

Alerting on authentication anomalies, unusual export volume, and privilege changes, with a defined severity ladder and an on-call owner for each level.

Containment and notification

Documented containment steps, including credential rotation and tenant-level isolation if required, with contractual notification windows for affected tenants.

Review

Every incident produces a written review with corrective actions tracked to completion. Affected tenants receive the findings, including ours.

Posture

What the platform is, and what it is not

Software sits underneath a licensed operation. Where that line falls is the question a compliance reviewer actually asks, so it is answered here rather than in a contract schedule.
  • Aurum Estate is software and infrastructure. We are not a brokerage, we do not act as a real estate broker, and we do not market properties on our own behalf.
  • We are not a lender, mortgage broker, or loan originator, and we do not originate, broker, arrange, or recommend any loan.
  • We do not hold or transmit funds as a principal. Rent, deposits, and earnest money are handled only by licensed payment and escrow partners.
  • The platform helps tenants operate compliantly and enforces the rules they configure. It does not make anyone compliant and does not guarantee compliance.
  • Rules vary by state, MLS, and city, and they change. Partners are responsible for review by their own counsel before launching.

Review with us

Send your security questionnaire before the demo

We would rather answer your reviewer's questions in week one than discover them in week ten. Send the questionnaire, your DPA redlines, or your data residency requirements and we will respond in writing.