// Trust & Security Report
Lofty Inc
AI-powered real estate CRM platform with lead generation, IDX websites, marketing automation, and agentic AI for agents, teams, and brokers. Includes mobile apps, power dialer, transaction management, and social studio.
Certifications held
3
Maturity
Growth
Trains on your data
Unknown
Trust center
Yes
// Certification ledger
Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.
Verify on lofty.com“Presented under a dedicated 'ISO 27001 Certification' section on Lofty's security-compliance page, which states verbatim: 'The International Organization for Standardization 27001 Standard (ISO 27001) is an information security standard that ensures office sites, development centers, support centers, and data centers are securely managed.' Note: the page gives a definitional description under a certification heading; no downloadable certificate or audit report is published.”
Verify on lofty.com“Presented under a dedicated 'ISO 27701 Certification' section on Lofty's security-compliance page, which states verbatim: 'ISO 27701 is the international standard for privacy information management.' Note: definitional description under a certification heading; no downloadable certificate is published.”
Verify on lofty.com“Presented under a dedicated 'SOC 2 Report' section on Lofty's security-compliance page, which states verbatim: 'A SOC 2 report is a report that service organizations receive and share with stakeholders to demonstrate that general IT controls are in place to secure the service provided.' Note: this is a generic description of a SOC 2 report under a section heading; the text does not name Lofty as the report holder, and no audit report or attestation letter is published.”
> Show 3 unconfirmed / not-held certifications
source: lofty.comType not specified in public documentation. Vendor states 'SOC 2 documentation' exists but does not clarify whether Type I or Type II audit.
source: lofty.comNo public evidence of HIPAA compliance. Real estate CRM is not a healthcare product; HIPAA not applicable or mentioned.
No public evidence of ISO 42001 AI governance certification despite heavy use of agentic AI features.
// Privacy & AI training
Trains on customer data
Not stated
Data processing agreement
Offered
Data region
United States (data collected, transferred to, and stored in US per section 3.9)
CRITICAL GAP: Privacy policy does not explicitly state whether customer data is used for training Lofty's agentic AI models. OpenAI is listed as an approved sub-processor but the purpose and scope of data sharing are not clearly defined. Customer conversations and interactions involve AI agents, but opt-out mechanisms or data minimization practices are not documented.
// Security controls
Employee Security Training
Security awareness training required for all employees on hire and annually
lofty.com// Products & data scope
data: Customer contact data, lead pipeline, communication history, property information
Purpose-built for real estate with agentic AI for autonomous lead engagement and follow-up. AI handles call prep, follow-ups, notes, and content creation.
data: Website visitor data, lead inquiry forms, property search behavior
Intelligent IDX system for lead generation and capture. Includes website customization and branding.
data: Customer contact lists, email engagement, marketing campaign performance
Automated 'Smart Plans' for lead nurturing across 33+ lead generation channels including Google PPC, Google LSA, local farming, and direct mail.
data: Conversation logs, lead interactions, scheduling, appointment booking, follow-up messaging
Autonomous AI agents trained on real estate conversation patterns. Handles appointment booking, lead filtering, and real-time guidance during calls. All AI actions are logged in CRM.
data: CRM data, lead information, communication history, property details
Full-featured mobile app for on-the-go access. Also includes Closely App, a separate mobile-optimized home search experience for clients.
data: Call logs, message history, contact records
Integrated calling and messaging from CRM with AI-enhanced call prep and follow-ups.
data: Transaction details, document management, deal pipeline
Manages the complete transaction lifecycle from lead to settlement.
// What to watch
- AI_TRAINING_AMBIGUITY: Privacy policy does not explicitly disclose whether customer data (conversations, lead interactions, call logs) is used to train Lofty's agentic AI models. OpenAI is listed as a sub-processor but the data flow and training purpose are unclear. This is critical given AI is a primary product feature.
- SOC_2_TYPE_UNSPECIFIED: Vendor claims SOC 2 certification but does not specify Type I vs Type II. Type I covers design of controls, Type II covers operation over a 6+ month period—substantively different assurance levels.
- NO_PUBLIC_SOC2_REPORT: Unlike enterprise SaaS vendors, no public SOC 2 audit report, trust certificate, or third-party verification link is provided. Certification claim is stated but not independently verifiable.
- OPENAI_SUBPROCESSOR_UNCLEAR: 22 sub-processors listed including OpenAI, Google Cloud, AWS, Zendesk; however, the scope and purpose of customer data shared with each is not clearly articulated in the DPA.
- MISSING_ISO_42001: Despite marketing agentic AI as a core feature and heavy use of AI agents for autonomous decision-making, no ISO 42001 AI governance certification is held. This gap may be relevant for enterprise buyers in regulated industries.
- NO_HIPAA_DESPITE_SENSITIVE_DATA: While not a healthcare product, Lofty processes contact information, communication records, and lead data which could be sensitive for certain users; no Business Associate Agreement (BAA) option appears available.
- DATA_REGION_LOCK: Data is stored exclusively in the US; no option for EU data residency despite GDPR compliance claims. Organizations with data residency mandates cannot use Lofty.
// At a glance
Pricing model
Subscription-based SaaS; no public pricing listed; requires demo/sales inquiry; 'Smart Plans' available for agents, teams, and brokers
Self-hostable
No
// How we verified this
Every certification marked HELD is confirmed against a verbatim quote on Lofty Inc's own trust, security, or privacy pages. We reject certifications claimed only on third-party aggregators, on a cloud host's behalf, or by a similarly named company.
Last verified 2026-07-07. Compliance changes over time. Always confirm directly with the vendor before relying on any certification for a purchasing or compliance decision.
lofty.com