Revolution RE handles sensitive operational and financial data. These are the controls that protect it. The full statement is on our Data Security page.
| Control | In practice |
|---|---|
| SOC 2 | Independently audited against the AICPA Trust Services Criteria. |
| Read-only PMS access | Revolution RE can only read from your source systems. It cannot write, modify or delete source data — an architectural constraint, not a setting. |
| Encryption | TLS 1.2 or higher in transit; AES-128 or higher at rest, including exports and backups. |
| Least-privilege access | No Revolution RE employee has standing access to customer data. Access is granted case by case, logged, reviewed and time-limited. MFA is required for all internal access. |
| Your permissions are yours | Your Administrator controls who sees which properties and data views. Revolution RE cannot override them. |
| Data retention | Kept for your subscription and a post-termination grace period set in your agreement, then permanently deleted. You can request confirmation of deletion. |
Your part
Two controls sit with your team:
- Permissions — review who can see which properties, and deactivate users who leave. See Managing users.
- Embed links open without a login. Share them only where they belong, and restrict them to specific properties. See Embeds.
SOC 2 reports and security reviews
For a SOC 2 report, a security questionnaire, a DPA or a review session, use the contact form on the Data Security page. The team typically responds within one to two business days. To report a suspected security issue, use the same form.