Security and GDPR
Frequently asked questions on “Security and GDPR”, with the details specific to your market where the rules depend on it.
How is our agency data isolated from that of other clients?
Every record carries the identifier of the organisation to which it belongs, and access rules are enforced by the database itself rather than solely by the application. A query can therefore never return data belonging to another organisation, even in the event of an interface error.
See also: Security and data protection
Link to this questionHow are roles and access rights managed within our organisation?
Access rights are assigned by role within the organisation, ensuring that each user sees only the functions required for their work. For example, the REOS subscription area and invoices are visible only to administrators and accountants, and this rule is enforced at the database level. Owners, tenants, co-owners and service providers have separate access rights that are restricted to their own file.
See also: Security and data protection
Link to this questionWhere are our data and documents physically hosted?
Data and files are hosted within the European Union. Communications are encrypted in transit and data is encrypted at rest, which protects the personal and commercial information contained within a property portfolio.
See also: Security and data protection
Link to this questionHow do public links shared with third parties function, and are they secure?
Public pages rely on long, random and revocable tokens that never reveal the raw identifier of a private record. This architecture allows you to revoke access at any time from the portal so that the relevant link ceases to function immediately.
See also: Security and data protection
Link to this questionWhat is the data retention period, and what happens to a rejected rental application file?
Retention follows the conditions stipulated in the contract, and data is deleted upon its termination. Certain retention periods are applied automatically: rejected application files are deleted after six months, whereas anti-money laundering due diligence records are retained for five years in accordance with this legal obligation.
See also: Security and data protection
Link to this questionCan we retrieve the entirety of our data if we wish to do so?
Yes. You can obtain a structured export of your data upon request, which guarantees data portability if you change software solutions. Furthermore, accounting journals, the mandate register and several lists can be exported at any time in CSV or Excel format from your workstation.
See also: Security and data protection
Link to this questionWhere and how can we report a security vulnerability?
Vulnerabilities should be reported by email to [email protected] so that the technical team can investigate them. An acknowledgement of receipt is sent within two working days, and the person who reported the vulnerability is kept informed until the matter is closed.
See also: Security and data protection
Link to this questionHow are outgoing emails managed to ensure traceability?
Emails are not sent directly from the screen interface: they are placed in a queue that sends them and retries up to three times in the event of a failure. Each transmission is logged, which allows you to verify that a statement, a reminder or a notification has indeed been sent.
See also: Security and data protection
Link to this questionAsk a question
The assistant answers from the FAQ and the user guide, in the language of this page. When the information is not available, it says so and offers to pass your request on to the REOS team.
The assistant requires JavaScript. You can also write to us from the contact page so that the team can answer you directly. Contact REOS
A question that calls for a conversation
A demonstration on a structure close to yours lets you check, with your own cases, how REOS handles your portfolio.