Security & Trust

Your data is yours. Completely.

REX works with your leases, your tenants, and your financials. That only works on trust. Six commitments — anchored by independent examination.

Request a demo Full trust center

The Commitments

Six commitments to how we handle your data.

01Ownership

Your data stays yours

Your leases, your tenants, your financials, your history. The records and institutional memory REX works from live on your Grid. When REX remembers why a deal was structured a certain way, it remembers it for you — that knowledge is part of your portfolio, not ours.

The Grid · Memory

02Control

Your data works for you alone

REX's intelligence comes from your Grid — your buildings, your leases, your decisions. The platform is designed so what it learns about your portfolio serves your portfolio. Your data is encrypted in transit and at rest, and its use is governed by your agreement with HqO.

Governed by your agreement

03Access

Boundaries that match how CRE works

Segregate the tenant data. Scope the JV partner. Bound the fund. The platform is designed around the access boundaries that matter in commercial real estate — tenant data segregation, joint-venture partner visibility, and fund-level separation — with single sign-on via SAML.

SSO via SAML

04Examination

Independently examined

HqO is ISO 27001:2022 certified. Our SOC 2 Type II report — obtained through examination by an independent third party — is available on request. We also maintain a CSA STAR Level 1 self-assessment (CAIQ v4.02). Don't take our word for it. Take theirs.

ISO 27001:2022 · SOC 2 Type II report · CSA STAR Level 1

05Protection

Encrypted and tested, continuously

Data is encrypted with TLS 1.2+ in transit and AES-256 at rest. Vulnerability scanning runs every two weeks. External penetration testing runs annually. Security is a schedule, not a statement.

TLS 1.2+ · AES-256

06Privacy

Privacy and residency, by regulation

HqO supports GDPR, CCPA, and PIPEDA, and participates in the EU-U.S., UK, and Swiss Data Privacy Framework. Hosting runs on AWS in US East (N. Virginia) and EU Central (Frankfurt), so data can stay in the region where your portfolio operates.

AWS US East (N. Virginia) · EU Central (Frankfurt)

Your records and memory live on your Grid

See the Digital Grid

Documentation

Read the record.

The certifications, examinations, and policies behind these commitments are published and maintained. The SOC 2 Type II report is available on request.

Full trust center

Certifications, examinations, and security practices, maintained by HqO.

Open

Legal documents