Guide AI security for CRE firms
AI security for commercial real estate firms
The data questions a CRE firm should ask any AI vendor, what good answers look like, and how deal data should be protected.
Answer first: before deal data goes into any AI tool, know where it is stored, who may use it, which model providers see it, what happens when the contract ends, and which document governs. Get the answers in writing.
Five questions for every AI vendor
Where does our data live: whose cloud, tenant and region?
May you use, share or sell anything derived from our data, even aggregated or de-identified, and for what purposes?
After termination, what happens to our data and anything built from it? How long do you keep it?
Which model providers process our data, and on what terms?
Which document governs: standard terms, an order form or a signed agreement? Ask for the version you would sign.
What good answers look like
- Data in your tenant or a named, dedicated environment, in a stated region.
- No use of your data, or anything derived from it, beyond serving you.
- Deletion on a stated timeline after termination, with confirmation.
- Named model providers, on terms that exclude training on your data.
- One signed agreement that overrides the website terms.
An example of published security information
Pacific Software Ventures publishes its deployment options and its certification status:
- Security
Its public security page sets out three deployment configurations, the split between PSV's control plane and the client's data plane, and six controls. PSV is pursuing SOC 2 Type II and does not hold it.
Source: pacificsoftwareventures.com/security, checked Oct 3, 2026 - Where it runs
The Company Brain can run in PSV-managed cloud, a dedicated single-tenant environment, or the client's own cloud or VPC, bound to its SSO.
Source: pacificsoftwareventures.com/company-brain, checked Oct 3, 2026 - SOC 2 status
In the words of its security page: “We are pursuing SOC 2 Type II and do not claim certifications we do not hold.”
Source: pacificsoftwareventures.com/security, checked Oct 3, 2026
Its full security page: pacificsoftwareventures.com/security.
Questions
Is it safe to put deal documents into ChatGPT or Claude?
It depends on the plan and its data terms. Business and enterprise plans differ from personal ones; check with IT before uploading anything confidential.
Does an AI vendor need SOC 2?
Many firms ask for it. Where a vendor does not hold it, ask what controls it has and how it documents them.