Your files stay yours
Rent rolls, models and data rooms are the firm's most sensitive material. Titleman keeps each firm's data isolated, never trains on it, and records who ran what, when, and on which sources.
What the contracts say
For your IT and legal team: each line below is written into a document you can read in full.
- No training on your contentWe do not train AI models on your content or customer data. Our subprocessors do not either, and they do not retain or log it for human review.Platform Agreement, section 12.8 →
- Returned or deletedOn your request, or within 30 days after the service ends, we return or delete your data and direct every subprocessor to do the same.Data Processing Addendum →
- Every subprocessor namedEach third party that processes data for us is listed with what it processes and where. A new one is published 30 days before it starts, and you can object within 15 days.Subprocessor list →
- Never in our officesYour data is hosted in data centers and never in our offices. Only staff who need it to run the service can reach it.Security Addendum →
For our NDA, or to send your security questionnaire, write to [email protected].
Trust Center
The controls behind the promises above, and every document your IT, legal and procurement teams will ask for, in one place.
- Encryption in transitAll traffic between your browser or API client and our servers is encrypted.Privacy Policy, section 10 →
- Encryption at restThe database is encrypted, with managed keys.Privacy Policy, section 10 →
- AccessRole-based access, multi-factor authentication and regular access reviews, so only the staff who need it can reach your data.Privacy Policy, section 10 →
- HostingData centers in Germany (EU) certified to ISO 27001.Privacy Policy, section 10 →
- BackupsContinuous backups, so a failure costs as little time and data as it can.Privacy Policy, section 10 →
- IncidentsA documented response process, and notice to affected customers within 72 hours of confirming a notifiable breach.Privacy Policy, section 10 →
- CertificationsSOC 2 Type II and ISO 27001 programs are under way. Neither is claimed until it is issued.Privacy Policy, section 10 →
Documents for your review
- Platform Agreement →
- Data Processing Addendum →
- Data Transfer Addendum →
- Security Addendum →
- Subprocessor list →
- AI Policy →
- Support and service level terms →
- Privacy Policy →
For our NDA, or to send your security questionnaire, write to [email protected].
Questions to ask any AI vendor, answered
Do you train AI models on our files?
No. Your rent rolls, models and data rooms are used to answer your jobs and nothing else. Platform Agreement, section 12.8 →
Do your subprocessors keep or review our data?
They do not train on it, and they do not retain or log it for human review. Platform Agreement, section 12.8 →
Is our data kept apart from other customers’?
Yes. Each account’s material is isolated and nothing is pooled across customers.
Can we see who ran what?
Every run is recorded: who ran it, on which sources, with which template.
What happens to our data when we leave?
On your request, or within 30 days after the service ends, it is returned or deleted, and every subprocessor is directed to do the same. Data Processing Addendum →
Who else processes our data?
Every subprocessor is named with what it processes and where. A new one is published 30 days before it starts, and you can object within 15 days. Subprocessor list →
Can it run inside our own environment?
Yes, for corporate engagements: inside the institution, against your policy set and systems of record.
Where is our data hosted?
In data centers, never in our offices. Only staff who need it to run the service can reach it. Security Addendum →