Information Security Policy

1. Overview

Broker Matrix, LLC ("Broker Matrix," "we," "us," or "our") is committed to protecting the confidentiality, integrity, and availability of data processed by the Deal Animal platform (the "Service"). This Information Security Policy outlines the administrative, technical, and physical safeguards we implement to protect user data, real estate transaction records, commission information, and third-party integration data.

This policy applies to all systems, personnel, and processes involved in the delivery of the Service.

2. Data Encryption

2.1 Encryption in Transit

All data transmitted between users, the Service, and third-party integrations is encrypted using Transport Layer Security (TLS) version 1.2 or higher. This applies to:

• Browser-to-server communications via HTTPS with HSTS enforcement.
• Server-to-database connections via TLS-encrypted PostgreSQL connections.
• API requests to and from third-party integrations.
• Internal service-to-service communication within our infrastructure.

2.2 Encryption at Rest

All data stored within the Service is encrypted at rest using AES-256 encryption, provided by Supabase's managed PostgreSQL infrastructure. This includes:

• Database tables containing user data, transaction records, and commission information.
• Database backups and point-in-time recovery snapshots.
• File storage for uploaded documents and media.
• Cached data in Upstash Redis, encrypted via TLS connections and at-rest encryption.

3. Authentication and Identity Management

3.1 Authentication Provider

User authentication is managed through Supabase Auth, which provides:

• Secure email/password authentication with bcrypt password hashing.
• OAuth 2.0 / OpenID Connect social login providers.
• Magic link and one-time password (OTP) authentication flows.
• Multi-factor authentication (MFA) support via TOTP.

3.2 Token Management

Session management uses short-lived JSON Web Tokens (JWTs) with automatic refresh token rotation. Access tokens have a maximum lifetime of one (1) hour, and refresh tokens are rotated on every use to mitigate token theft.

3.3 Row Level Security (RLS)

All database tables are protected by Supabase Row Level Security policies. RLS ensures that authenticated users can only query, insert, update, or delete records belonging to their own organization. This enforcement occurs at the database level, providing defense-in-depth independent of application logic.

4. Access Controls

4.1 Role-Based Access Control (RBAC)

The Service implements role-based access control with the following principal roles:

• Owner — full administrative control over the organization, including billing, member management, and data export.
• Admin — organization management privileges including user provisioning, integration configuration, and reporting.
• Manager — team-level management with access to team member data, transactions, and commission structures.
• Agent — standard user access limited to personal data, assigned leads, and individual transactions.

4.2 Organization Scoping

All data access is scoped to the user's organization. Cross- organization data access is architecturally prevented through database-level isolation using organization identifiers enforced by RLS policies.

4.3 Principle of Least Privilege

All system access — including employee access, API keys, and service accounts — follows the principle of least privilege. Permissions are granted only as necessary to perform specific functions and are reviewed on a quarterly basis.

5. Infrastructure Security

5.1 Application Hosting

The Service is hosted on the Vercel Edge Network, which provides:

• Global edge distribution with automatic DDoS protection.
• Automatic SSL certificate provisioning and renewal.
• Immutable deployments with instant rollback capabilities.
• SOC 2 Type II certified infrastructure.

5.2 Database Infrastructure

The primary database is Supabase-managed PostgreSQL running on AWS infrastructure, which provides:

• Automated daily backups with point-in-time recovery (PITR).
• Network isolation within a Virtual Private Cloud (VPC).
• Connection pooling via PgBouncer for secure, efficient database access.
• Automatic minor version security patches.

5.3 Edge Caching and Rate Limiting

We use Upstash Redis for rate limiting, caching, and queue management. Upstash provides serverless Redis with TLS-encrypted connections, SOC 2 compliance, and regional data residency options.

6. API Security

6.1 Rate Limiting

All API endpoints are protected by rate limiting implemented via Upstash Redis. Rate limits are configured per endpoint, per user, and per organization to prevent abuse and ensure fair usage. Requests exceeding rate limits receive a 429 Too Many Requests response with a Retry-After header.

6.2 OAuth 2.0 for Third-Party Integrations

Third-party integrations (KW Command, Salesforce, Google Workspace, etc.) authenticate using the OAuth 2.0 authorization code flow. We implement:

• PKCE (Proof Key for Code Exchange) where supported by the provider.
• State parameter validation to prevent CSRF attacks.
• Scoped access requests — we request only the minimum permissions necessary.

6.3 Third-Party Token Management

OAuth tokens obtained from third-party integrations are:

• Encrypted before storage using application-level encryption with keys managed separately from the database.
• Automatically refreshed before expiration to maintain uninterrupted service.
• Immediately revoked and purged when a user disconnects an integration.
• Scoped to specific organizations and never shared across tenants.

6.4 Input Validation and Sanitization

All API inputs are validated and sanitized using strict schema validation (Zod). Parameterized queries are used exclusively for database operations to prevent SQL injection. Output is encoded to prevent cross-site scripting (XSS) attacks.

7. Incident Response

7.1 Incident Classification

Security incidents are classified by severity:

• Critical — confirmed data breach, unauthorized access to production systems, or active exploitation of a vulnerability.
• High — potential data exposure, successful phishing attempt, or compromise of credentials.
• Medium — detected vulnerability, anomalous access pattern, or failed intrusion attempt.
• Low — policy violation, minor misconfiguration, or informational security event.

7.2 Response Procedures

Our incident response follows a structured process:

1. Detection & Triage — automated monitoring and alerting systems detect anomalies; the security team performs initial assessment and classification.
2. Containment — isolate affected systems, revoke compromised credentials, and block malicious activity.
3. Investigation — conduct root cause analysis using audit logs, access records, and system forensics.
4. Remediation — deploy fixes, patch vulnerabilities, and restore services to normal operations.
5. Notification — notify affected users within seventy-two (72) hours of confirming a data breach, in compliance with GDPR and applicable state breach notification laws.
6. Post-Incident Review — conduct a blameless retrospective and update security controls to prevent recurrence.

8. Data Backup and Disaster Recovery

8.1 Backup Strategy

• Daily Automated Backups — full database snapshots are taken daily and retained for thirty (30) days.
• Point-in-Time Recovery (PITR) — WAL (Write-Ahead Logging) archiving enables recovery to any point within the retention window.
• Geographically Redundant Storage — backups are stored in a geographically separate region from the primary database to protect against regional outages.

8.2 Recovery Objectives

• Recovery Time Objective (RTO) — four (4) hours for full service restoration.
• Recovery Point Objective (RPO) — less than one (1) hour of data loss under normal conditions, enabled by continuous WAL archiving.

8.3 Application Resilience

The application layer on Vercel supports instant rollback to any previous deployment, zero-downtime deployments, and automatic failover across global edge locations.

9. Employee Access Controls

• All employee access to production systems requires multi-factor authentication.
• Access is granted on a need-to-know basis and reviewed quarterly.
• Administrative access to databases and infrastructure is restricted to authorized engineering personnel and is logged for audit purposes.
• All employees with access to customer data are bound by confidentiality agreements.
• Access is immediately revoked upon employment termination or role change.
• Security awareness training is conducted annually for all personnel.

10. Compliance and Certifications

10.1 SOC 2 Type II Alignment

Broker Matrix's security controls are designed in alignment with the SOC 2 Type II trust service criteria (Security, Availability, Processing Integrity, Confidentiality, and Privacy). Our infrastructure providers — Supabase, Vercel, and Upstash — maintain independent SOC 2 Type II certifications.

10.2 GDPR Compliance

We implement technical and organizational measures to comply with the General Data Protection Regulation, including data minimization, purpose limitation, storage limitation, and data subject rights enforcement. See our Privacy Policy for details.

10.3 CCPA Compliance

We comply with the California Consumer Privacy Act and its amendments (CPRA), providing California residents with the rights to know, delete, correct, and opt out. See our Privacy Policy for details.

11. Vulnerability Management

11.1 Dependency Scanning

Automated dependency scanning is performed on every code change to identify known vulnerabilities in third-party libraries. Critical and high-severity vulnerabilities are patched within forty-eight (48) hours of detection.

11.2 Code Review

All code changes undergo peer review before deployment. Security- sensitive changes (authentication, authorization, data access, encryption) require review by a designated security-aware engineer.

11.3 Penetration Testing

We conduct regular security assessments, including automated vulnerability scanning and periodic third-party penetration testing, to identify and remediate security weaknesses.

11.4 Responsible Disclosure

We welcome responsible security research. If you discover a vulnerability, please report it to eli@dealcloser.ai with a detailed description. We commit to acknowledging reports within two (2) business days and providing an initial assessment within five (5) business days.

12. Third-Party Vendor Security Assessment

All third-party vendors that process, store, or have access to user data are evaluated against the following criteria before integration:

• Security Certifications — SOC 2 Type II, ISO 27001, or equivalent certifications.
• Data Encryption — encryption at rest and in transit using industry-standard algorithms.
• Access Controls — role-based access, multi-factor authentication, and audit logging.
• Incident Response — documented incident response plan with defined notification timelines.
• Data Processing Agreements — contractual commitments governing data handling, retention, and deletion.
• Compliance — adherence to GDPR, CCPA, and other applicable regulations.

Vendor security posture is reassessed annually or upon significant changes to the vendor's services.

13. Monitoring and Logging

• All authentication events, API access, and administrative actions are logged with timestamps, source IPs, and user identifiers.
• Logs are retained for a minimum of ninety (90) days and are stored in a tamper-resistant format.
• Automated alerting is configured for anomalous patterns including brute-force attempts, unusual geographic access, and privilege escalation.
• Application performance and error monitoring is provided by Vercel's built-in observability tools and supplemented by PostHog event tracking.

14. Policy Review and Updates

This Information Security Policy is reviewed at least annually and updated as necessary to reflect changes in our infrastructure, regulatory requirements, or threat landscape. Material changes will be communicated to users through the Service or via email.

15. Contact for Security Concerns

If you have security concerns, wish to report a vulnerability, or have questions about this policy, please contact us: