Your data — and your clients' data — is safe with us.
RealPilot is GDPR-compliant by design, with data hosted in German data centres, technically isolated tenants, and a unique dual-representation safeguard that never exchanges plain-text contact data between brokers.
EU hosting (Frankfurt)
Database, images and files are physically located in a German data centre. US providers (Cloudflare CDN) only see static HTML, never your database contents.
Encrypted — everywhere
TLS 1.2+ for every connection (like online banking). At-rest encryption in the database. Passwords stored exclusively as bcrypt hashes.
Client hashes instead of plain-text
End-customer contact data is additionally cryptographically hashed. Other agents detect dual representation — but never see the actual plain-text data.
Database in Germany — service worldwide
The central database — including profiles, clients, properties, cooperations and chat history — lives in a Frankfurt data centre (Supabase eu-central-1). Sensitive content stays physically inside the EU.
| Data type | Location |
|---|---|
| Database contents | Frankfurt (DE) — eu-central-1 |
| Images + file uploads | Frankfurt (DE) |
| Payment processing (Stripe) | Dublin (IE) |
| Web cache (Cloudflare CDN) | EU edge (no database access) |
Three layers of protection
Whether in transit, at rest or as login credential — your data is always encrypted.
In transit
TLS 1.2+
Every connection to RealPilot runs over encrypted HTTPS — same standard as online banking.
At rest
AES-256
Database and file storage are encrypted at rest. Even a stolen backup medium would be worthless.
Passwords
bcrypt hash
We never store your plain-text password. Only a salted bcrypt hash — not reversible.
You see only your own data — and so do we, mostly.
Every database row is locked via Row Level Security (RLS) to its owner (or explicitly authorised cooperation partners). Even RealPilot staff can't just peek into your client list — every administrative access is logged.
- RLS at database layer — no app bug can bypass it
- RealPilot staff access only via two-factor auth + audit log
- No one but you sees your clients — only anonymised search profiles appear in the Hub
- Support-related access by us is separately documented
Example — RLS rule on the clients table:
create policy clients_select_own on public.clients for select using (owner_agent_id = auth.uid()); → You only see rows where YOU are the owner. → Other agents? Not a single row.
Conflict detection without plain-text data exchange
When two agents represent the same end-customer in parallel, a legal dual-representation problem arises. Standard industry solution: exchange contact lists — a GDPR nightmare.
Our solution: we additionally store email, phone and name of your end-customers as a SHA-256 cryptographic hash with a server-side salt. Other agents only see the hash result — never your plain-text data. Yet the system detects overlaps and warns before a match attempt.
Plain-text input from your client
klaus.mueller@example.com
a3f9c2b1...e4d8 (SHA-256)
Other agents only see the hash. The original email cannot be reconstructed from the hash.
Fully GDPR-compliant — with every contract you need
We provide all the legal documentation you need as the controller of your end-customer data.
GDPR Privacy Policy
Complete according to Art. 13 GDPR with sub-processor list, third-country notice and all data subject rights.
Data Processing Agreement (DPA)
Pursuant to Art. 28 GDPR — automatically becomes part of the contract on your registration.
Sub-processor list
Transparent overview of all providers (Supabase, Cloudflare, Resend, Workspace, Stripe) with third-country status.
GTC incl. § 7a Client protection clause
Commission claim between brokers explicitly regulated — 12 months from both-sided viewing confirmation.
What happens during a security incident?
In an emergency we follow our internal incident-response playbook and GDPR obligations:
- •Detection and immediate containment within the first hour
- •Notification to the supervisory authority (AEPD) within the legal 72-hour window (Art. 33 GDPR)
- •Direct notification of all affected broker customers, if their data was concretely affected (Art. 34 GDPR)
Want to know in detail?
Read our full privacy policy or write to our data-protection team directly — we typically reply within 24 hours.