Security & Trust

REI Compass™ is designed to help protect user information and the investment workspace data you build inside the platform — your deals, analyses, Power Team, journal, goals, and reports. Security is not a feature we bolt on; it is a product-level requirement that shapes how we build.

Account-level protections currently in place include:

• Secure authentication flows powered by Supabase Auth
• Email verification during account creation
• Industry-standard password hashing (passwords are never stored in plain text)
• Password reset protection with short-lived, single-use reset links
• Optional Multi-Factor Authentication (MFA) for users where available
• Required Multi-Factor Authentication (MFA) for admin accounts

Every REI Compass™ user has their own isolated workspace. Your data is separated from other users' data at the database level and enforced on every request.

Other users cannot access your:

• Deals
• Property analysis and calculator data
• Reports
• Journal entries
• Power Team contacts
• Goals
• Saved analysis and notes

Data isolation is enforced by Row Level Security policies in our database, meaning the platform itself blocks any request that tries to read or modify data belonging to another user.

REI Compass™ uses Cloudflare Turnstile on signup, sign-in, and password reset flows to help block automated bots and credential-stuffing attempts before they reach your account.

Turnstile works quietly in the background in most cases, so you can sign in normally without solving traditional CAPTCHAs.

Access to administrative functionality is tightly restricted:

• Admin access is limited to a small number of authorized personnel.
• Admin accounts are required to have Multi-Factor Authentication enabled.
• Administrative actions are logged for audit and incident-response purposes.
• Impersonation, when used for support, is read-only and time-limited — admins cannot make changes on your behalf.
• High-risk admin events (such as role changes or impersonation) are captured in security logs.

We know accidents happen. REI Compass™ provides recovery windows so a wrong click doesn't have to be permanent.

• Deleted items may generally be recoverable for approximately 30 days before permanent removal.
• Account deletion includes a recovery period during which the account can be restored.
• You may restore eligible deleted items from the Trash within the recovery window.

REI Compass™ does not store full payment card information. Payment processing will be handled by Stripe — or another secure, PCI-compliant payment provider — so card data does not touch our servers.

REI Compass™ does not collect any of the following:

• Social Security numbers
• Bank account numbers
• Government-issued identification
• Credit reports
• Tax returns

If a workflow ever appears to ask for information in these categories, please stop and contact us — that is not an intended REI Compass™ request.

Even the best-secured platform depends on good habits from the people using it. As a REI Compass™ user, you are responsible for:

• Choosing a strong, unique password and keeping it confidential
• Protecting the devices you use to access REI Compass™
• Not sharing your login credentials with anyone
• Enabling Multi-Factor Authentication where available
• Independently verifying all investment decisions before acting on any information generated by or entered into the Service

Report a Security Concern

If you notice anything unusual — an unexpected sign-in, a suspicious email claiming to be from REI Compass™, or a possible vulnerability — please contact us right away using the address below so we can investigate.

Questions about security, or want to report a concern? Reach out using the contact information below.