Trust
REX works with your leases, your tenants, and your financials. That only works on trust. Six commitments, anchored by independent examination, and an architecture built so one organization's data stays its own.
Security
Certified, examined, encrypted, and tested on a schedule. The wording below is HqO's own; the documents behind it are linked under Legal & privacy.
01Ownership
Your leases, your tenants, your financials, your history. The record REX works from lives on your Grid, and what REX remembers about your portfolio, it remembers for you. That knowledge is part of your portfolio, not ours.
The Grid · History · REX memory
02Control
REX's intelligence comes from your Grid: your buildings, your leases, your decisions. The platform is designed so what it learns about your portfolio serves your portfolio. Its use is governed by your agreement with HqO.
Governed by your agreement
03Access
Segregate the tenant data. Scope the JV partner. Bound the fund. The platform is designed around the access boundaries that matter in commercial real estate, with single sign-on via SAML.
SSO via SAML
04Examination
HqO is ISO 27001:2022 certified. Our SOC 2 Type II report, obtained through examination by an independent third party, is available on request. We also maintain a CSA STAR Level 1 self-assessment (CAIQ v4.02). Don't take our word for it. Take theirs.
ISO 27001:2022 · SOC 2 Type II report · CSA STAR Level 1
05Protection
Data is encrypted with TLS 1.2+ in transit and AES-256 at rest. Vulnerability scanning runs every two weeks. External penetration testing runs annually. Security is a schedule, not a statement.
TLS 1.2+ · AES-256
06Privacy
HqO supports GDPR, CCPA, and PIPEDA, and participates in the EU-U.S., UK, and Swiss Data Privacy Framework. Hosting runs on AWS in US East (N. Virginia) and EU Central (Frankfurt), so data can stay in the region where your portfolio operates.
AWS US East (N. Virginia) · EU Central (Frankfurt)
Sovereignty
Sovereignty is not a policy statement. It is where the data sits, what it informs, who can ask it questions, and what is allowed to leave. Four answers.
Approvals
An operator that can move dollars, doors, and tenant messages needs a rule about when it may. The rule is simple: before anything moves, a person approves it.
01Draft
REX prepares the work
REX prepares the work: the renewal package, the work-order dispatch, the tenant announcement.
02Log
Every step lands in History
Every draft, every source it drew on, and every decision is written to History, so the record shows what happened and why.
03Approve
Nothing moves until you say so
Nothing moves until a person approves it. Approval rules are yours to set, per agent and per action.
Legal & privacy
The certifications, examinations, and policies behind these commitments are published and maintained. The SOC 2 Type II report is available on request.
What HqO collects, why, and the rights you and your tenants have over it.
The agreement that governs the platform, dated June 5, 2026 (PDF).
Certifications, examinations, and security practices, maintained by HqO.
Every policy and agreement in one place, including data processing terms.
GDPR · CCPA · PIPEDA · EU-U.S., UK, and Swiss Data Privacy Framework
Who stands behind itBring your security questionnaire and a building. We'll answer the first and show you REX on the second.