On this page
Effective August 2026. Last updated September 2026.
Your leads and deals are your livelihood. Here's how we protect them.
In short
- Data encrypted in transit (TLS) and at rest (AES-256).
- Every agency's data is isolated at the database level — one agency can never query another's.
- Found a vulnerability? We welcome responsible disclosure and reply within 24 hours.
1. Our approach
Your leads and deals are your livelihood, so we treat security as a feature, not an afterthought. This page explains, in plain language, how we protect the data you trust us with.
2. Encryption
All traffic between your browser and RevaCore runs over TLS. Stored data — including leads, properties and messages — is encrypted at rest using AES-256.
3. Access control and data isolation
Every piece of workspace data is scoped to a single agency at the database level, enforced by row-level security policies — not just application logic. One agency's leads, properties and messages are never queryable by another agency, even in the event of an application bug. Inside RevaCore, access is role-based, and we log who accessed what.
4. Infrastructure
RevaCore is hosted on Vercel and Supabase, with automated backups and built-in disaster recovery. We rely on these providers' own security certifications and audits as part of our infrastructure — we recommend checking their current certifications directly, since compliance status can change over time.
5. Monitoring and backups
We monitor for failed logins, unusual access patterns and system errors, and keep automated backups of workspace data so a failure on our end doesn't mean losing your pipeline.
6. Incident response
If we discover or are notified of a security incident affecting your data, we investigate immediately, take steps to contain it, and notify affected agencies without undue delay, consistent with our obligations under applicable data-protection law.
7. Responsible disclosure
Found a vulnerability? Email [email protected] with details. We acknowledge reports within 24 hours, won't pursue legal action against good-faith researchers who report responsibly and avoid accessing other agencies' data, and credit researchers who want to be credited.
8. Certifications and compliance
RevaCore is a young, growing company. We don't yet hold formal certifications like SOC 2 ourselves, but we build on infrastructure providers that do, and apply the same security discipline — encryption, access control, audit logging — that those frameworks require. We'll pursue formal certification as RevaCore and its customer base grow.
9. Contact
Security question or report? Email [email protected].