Security
The controls we have, stated plainly
Investor data deserves precision, not badges. This page lists the security controls in place today — and is just as clear about the certifications we do not hold.
Updated
Tenant isolation
Every query is scoped to the sponsor firm that owns the data. Investors and residents are separate roles that can reach only their own records.
Two-factor authentication
TOTP two-factor authentication, enforced on the server, plus sign-in by password, email magic link or Google.
Roles and per-deal access
Owner, admin, manager, finance, IR and viewer roles, with per-member access to all deals or selected deals, and modules you can switch off for the firm.
Audit logs
Consequential actions — including signatures, verifications and lead captures — are recorded in an audit log.
Signature evidence kept by us
When a document is signed, the executed PDF and the signing audit certificate are stored with the deal, not only at the signing vendor.
Rate limiting
Tiered rate limits on public, authentication and API routes to slow down abuse and credential stuffing.
Encrypted in transit
All traffic is served over HTTPS. Stored integration credentials are encrypted with a dedicated key.
Daily backups
The production database and uploaded files are backed up daily and copied to a second server, with 14 and 30 days of retention.
Gated documents
Deal-room sections unlock by stage — NDA, accreditation, investment — and documents investors cannot see are not disclosed to them.
Money-path safeguards
Payment requests are idempotent and guarded against over-collection, and a failed payment is reported as failed — never as success.
People stay in charge of AI
AI agents draft and recommend; they cannot sign, vote or exercise fiduciary authority, and every figure they write is cited or marked unresolved.
Your data, exportable
Reports export to Excel, accounting to CSV and QuickBooks formats, and documents are downloadable. Your data belongs to you.
Where your data lives, and who else touches it
Checked against the production app on 2 October 2026. If this changes, this list changes first.
- Hosting: Hetzner, Hillsboro, Oregon (USA)
- The CREAssets app and its database run on a dedicated virtual server at Hetzner in Hillsboro, Oregon. Uploaded documents are stored on that server, and backups are copied daily to a second server.
- AI model provider: DeepInfra
- When you use an AI feature, the text that request needs is sent to DeepInfra to generate the answer. AI features start with the Platform plan; nothing is sent on the free Start stage.
- E-signature: a Documenso instance we operate
- Subscription documents are signed on a self-hosted Documenso e-signature server. The executed PDF and the signing certificate come back to the deal.
- Sign-in with Google: only if you choose it
- Google receives your sign-in only when you use “Sign in with Google”. Password, magic-link and two-factor sign-in stay with CREAssets.
- Payments: providers you connect
- ACH runs through the provider you connect with your own account — Dwolla, Stripe Treasury or Unit — under that provider’s terms. CREAssets never holds investor funds.
- Reporting a vulnerability
- Our disclosure contact is published in /.well-known/security.txt. Email the details and we respond; please do not test against other customers’ data.
Honest status
What we do not claim
- No SOC 2 or ISO 27001 report yet. We will not display a badge until an audit report exists.
- SAML single sign-on is not available yet. Google sign-in and two-factor authentication are.
- Identity checks are in-house. Our document and liveness checks are labelled as such; they are not a certified identity-verification vendor.
- Payments are US-only and run through licensed providers you connect. CREAssets does not hold funds.
Security review or questionnaire?
Send us your security questionnaire or due-diligence list and we will answer it in writing. To report a vulnerability, email us with the details and we will respond promptly. Please do not test against other customers’ data.
Related: how investors sign in to the investor portal, how subscriptions are signed and screened in digital closing, the status of each provider on the integrations page, and how we handle personal data in our privacy policy.
support@creassets.comRun your next raise on one platform.
Sign up free and build your first deal today. Upgrade only when you collect investor money — and if you are moving from another platform or from spreadsheets, we migrate you at no cost and your first month is free.