Encryption in Transit
All traffic between your browser and our servers is encrypted using HTTPS/TLS. We enforce HTTPS on both our frontend (Vercel) and backend (Railway) — there is no way to access REModel AI over an unencrypted connection.
Encryption at Rest
All data stored in our database is encrypted at rest using AES-256 encryption. This includes your project data, property details, financial models, and uploaded documents.
Data Isolation
Every database query is filtered through Row-Level Security (RLS) policies. This means you can only see your own projects and data — even if there were a bug in our application code, the database itself enforces that users cannot access each other's data.
Authentication
User authentication is handled by Supabase Auth with bcrypt password hashing, email verification, and secure session management. We enforce password complexity requirements (8+ characters with uppercase, lowercase, numbers, and special characters). Sessions automatically expire after 30 minutes of inactivity.
Document Handling
Documents you upload are processed in memory by our AI extraction pipeline. They are not written to our server's file system. Extracted data is stored in our encrypted database, and original documents are stored in encrypted cloud storage accessible only through authenticated requests.
Access Control
Team collaboration uses role-based permissions. Project owners control exactly who can access their projects and whether they get view-only or edit access. Team admins can manage membership but cannot access projects they haven't been explicitly granted access to.
No Secrets in Code
All API keys, database credentials, and service tokens are stored as environment variables on our hosting platforms — never committed to source code. This prevents accidental exposure through code repositories.
AI Processing
Document extraction uses Anthropic Claude and Google Gemini via their secure APIs. These providers process your data per their enterprise API data policies — data sent via API is not used to train their models. We send only the minimum necessary content for extraction.