Security at Rentalize
Rentalize stores platform data in EU data centres and processes personal data for you under a published GDPR Data Processing Agreement. Personal data is never used to train AI models, every AI action is logged, in Safe mode (the default) every change waits for your approval, and Talia runs on an AI engine that Rentalize sets up for your account. ISO 27001 certification is in progress: we do not hold the certificate yet. Our controls follow ISO 27018 and ISO 27701 guidance, and we are not certified to either.
- EU data storagePrimary hosting on Amazon Web Services in an EU region, backups in a second EU member state.
- No AI training on personal dataRentalize never uses your data to train AI models, and clause 4.5 of our Data Processing Agreement prohibits it.
- ISO 27001: in progressNot certified yet. ISO 27018 and 27701 aligned, not certified.
- 99.5% availability commitmentPer month from go-live, in our published Service Level Agreement.
Where is Rentalize data stored?
Rentalize platform data is stored in EU data centres. Our Data Processing Agreement names the location of processing as the European Union, with primary hosting on Amazon Web Services in an EU region and backups held in a second EU member state. Encryption keys are held in the European Union through the hosting provider's managed key service.
There are no transfers of personal data outside the European Economic Area in the ordinary course. If one were ever needed, the DPA allows it only on an adequacy decision or the European Commission's Standard Contractual Clauses, with a transfer impact assessment, and we must tell you in advance. Remote support access from outside the EEA counts as a transfer under the same clause.
One thing to know about AI. When you use Talia, our AI colleague, the prompts she needs are processed by the AI provider Rentalize has set up for your account. Your platform data is stored in the EU either way.
How does Rentalize handle GDPR?
You are the controller of your tenant, landlord and contractor data, and Rentalize is your processor under Article 28 of the GDPR. The terms are in our Data Processing Agreement, which is published and applies automatically as part of the subscription, so most customers need nothing more. If your organisation requires an executed Article 28 agreement, the same text is signed as an annex to your order, and a signed copy is available on request.
What the DPA commits us to, in plain terms:
- We notify you of a personal data breach within 48 hours of becoming aware of it, with an initial notification within 24 hours where it is likely to be high risk. Both are shorter than the 72 hours GDPR gives you as controller.
- We give you at least 30 days' written notice before adding or replacing a sub-processor, and you can object.
- You can export your data in open, machine readable formats at any time, at no charge.
- At the end of your contract we return or delete your data at your election, and certify deletion in writing.
The DPA also covers audits, data subject requests and sub-processors. Read it in full at rentalize.com/legal/dpa, alongside our privacy policy.
Is tenant data used to train AI models?
No. Tenant names, rent amounts and compliance records are never used to train AI models. Talia reads your live data each time you ask. The conversation, including the records she looked up, is stored encrypted in your Rentalize account so you can carry on where you left off. It is never used to train AI models. What Talia remembers is encrypted at rest, and she is instructed never to save PPS numbers, bank details or passwords. Multi-tenant isolation is enforced at every tool call, so the assistant only ever sees your own company's data.
The contract says the same. Clause 4.5 of our DPA prohibits us from using personal data to train any machine learning model. The one permitted use of data derived from the platform is irreversibly anonymised, aggregated statistics for product improvement and benchmarking under clause 5, from which no tenant, landlord, contractor or customer can be identified. You can opt out of that clause at any time, in writing, at no charge.
Which AI engine does Rentalize use?
Talia runs on an AI engine that Rentalize sets up for your account. The platform supports Anthropic, OpenAI and Google Gemini, so you are not locked to one vendor's model. Rentalize sets the AI provider and model for your account and holds the provider credentials. Your administrator decides whether Talia is on, which permission mode she runs in, and whether she may read connected mailboxes.
Your platform data is stored in the EU. The prompts Talia needs are processed by that AI provider. More detail is on the Talia and AI page.
AI audit trail, permission modes and the EU AI Act
Talia can take actions, not only answer questions, such as creating a task, logging a payment, sending an SMS or updating a ticket. In Safe mode, the default, Talia shows a preview of every change and nothing happens until someone confirms it. In Auto or Bypass mode, routine low-risk changes run without a prompt, and high-risk or bulk actions still ask first. Permission modes (Read-only, Safe, Auto, Bypass) control whether Talia can make changes and when she asks first. Your administrator sets the default for the company.
Every question and every change Talia makes is recorded against the person and the company: the conversation itself, plus a log of each action showing the permission mode and whether someone confirmed it. Administrators with the right permission can open a colleague's Talia conversation. Across the platform, changes to payments, invoices, permissions, tasks, tickets, cases, compliance and inventory records are logged with the user and the time, with role-based access, granular permissions, and approval steps for remittances and development decisions.
That record matters from 2 August 2026, when EU AI Act deployer duties apply to firms using AI on tenant-facing decisions. The logs are what an evaluator asks for, and they already exist for every AI action taken in Rentalize.
Is Rentalize ISO 27001 certified?
Not yet. ISO 27001 certification is in progress, and we do not hold the certificate today. We would rather say that plainly than have you find out at the security questionnaire stage.
ISO 27001
Information security management. We are working towards certification to the international standard for protecting the confidentiality, integrity and availability of data.
ISO 27018
Protection of personal data in the cloud. Our controls follow its guidance. We are not certified to it.
ISO 27701
Privacy information management. Our privacy controls follow its guidance, which extends ISO 27001 with controls aligned to GDPR. We are not certified to it.
If your procurement requires a certificate by a set date, ask us for the current status before you decide.
Access control, encryption and backups
The technical and organisational measures we maintain are set out in Annex A of the Data Processing Agreement, which does not allow us to reduce the overall level of security during your contract. They include:
- Role-based access control on the principle of least privilege, with two-factor authentication (authenticator app or email code, with recovery codes) available to every user.
- Encryption in transit using TLS 1.2 or above, and encryption at rest for databases, object storage and backups.
- Encrypted daily backups, retained for at least 30 days and held within the European Union, with restoration tested at least quarterly.
- Separate production, staging and development environments, with no live personal data in development.
- Independent penetration testing at least annually, with findings tracked to closure.
The full list, including monitoring, incident response and supplier checks, is in the DPA itself.
What uptime does Rentalize commit to?
Our Service Level Agreement commits to platform availability of 99.5 per cent in each month from your go-live date, with service credits if we miss it. Availability is measured by automated monitoring that runs independently of the platform, polling from outside the hosting environment, so the monthly figure is not compiled by hand. One service level applies to every commercial customer.
The platform has held up where it counts. Rentalize Select has processed more than 200,000 applications with zero downtime through intake peaks, including a single week of 4,600.
Security FAQ
Does Rentalize sign a Data Processing Agreement?
Yes. Our Data Processing Agreement is published at rentalize.com/legal/dpa and applies automatically as part of the subscription. Where an organisation requires an executed Article 28 agreement, the same text is signed as an annex to the order form, and a signed copy is available on request.
Is Rentalize data stored in the EU?
Yes. Platform data is stored in EU data centres: primary hosting on Amazon Web Services in an EU region, with backups in a second EU member state. When you use Talia, the prompts she needs are processed by the AI provider Rentalize has set up for your account.
Is Rentalize ISO 27001 certified?
Not yet. ISO 27001 certification is in progress and we do not hold the certificate. Our controls follow ISO 27018 and ISO 27701 guidance, and we are not certified to either standard.
Is tenant data used to train AI?
No. Personal data is never used to train AI models, and clause 4.5 of our Data Processing Agreement prohibits it. Only irreversibly anonymised, aggregated statistics may be used for product improvement and benchmarking, and you can opt out of that at any time at no charge.
Can we choose which AI model Rentalize uses?
Talia runs on an AI engine that Rentalize sets up for your account. The platform supports Anthropic, OpenAI and Google Gemini, so you are not locked to one vendor's model. In Safe mode, the default, every AI action shows a preview and waits for confirmation, and every question and every change Talia makes is recorded against the person and the company.
How quickly would we be told about a data breach?
Within 48 hours of us becoming aware of it, with an initial notification within 24 hours where the breach is likely to be high risk to the people affected. Both are shorter than the 72 hours GDPR gives a controller, so you keep time to assess and notify.
Working through a security questionnaire?
Book a 45-minute demo and bring your questions, or ask us to call you first. The documents procurement teams usually ask for are linked below.