How REOS is built.

Security

What follows is a description of how the platform is built. It is deliberately limited to things that are true of the system today.

Hosting and transport

• The application and its database run on Supabase (managed PostgreSQL). The marketing site and application bundles are served by Netlify.
• All traffic is served over HTTPS. Data at rest is encrypted by the database provider.

Accounts

• Authentication is handled by Supabase Auth. REOS never stores your password — it is hashed by the auth provider and is not readable by us.
• Passwords must be at least 12 characters. Google sign-in is available as an alternative.

Data access

• Customer data is protected by row-level security in the database, so an account's credentials can reach only that account's rows.
• Internal usage records are stricter still: they deny all access to client credentials entirely and are readable only by internal services. No customer key can read them by any route.
• Usage records hold identifiers and timings only. They contain no free-text field, so nothing you type into REOS is ever written to them.

Your data, and removing it

• Deletion is a documented route rather than a later feature — see Privacy for what is collected on this site and how to have it removed.
• Property information in REOS is assembled from public record and public GIS services. It is not purchased from data brokers and does not describe REOS users.