// Trust & Security Report
Lofty
AI-powered real estate CRM platform with lead generation, IDX websites, marketing automation, and agentic AI for agents, teams, and brokers. Includes mobile apps, power dialer, transaction management, and social studio.
Certifications held
3
Maturity
Growth
Trains on your data
Unknown
Trust center
Yes
// Certification ledger
Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.
Verify on lofty.com“Presented under a dedicated 'ISO 27001 Certification' section on Lofty's security-compliance page, which states verbatim: 'The International Organization for Standardization 27001 Standard (ISO 27001) is an information security standard that ensures office sites, development centers, support centers, and data centers are securely managed.' Note: the page gives a definitional description under a certification heading; no downloadable certificate or audit report is published.”
Verify on lofty.com“Presented under a dedicated 'ISO 27701 Certification' section on Lofty's security-compliance page, which states verbatim: 'ISO 27701 is the international standard for privacy information management.' Note: definitional description under a certification heading; no downloadable certificate is published.”
Verify on lofty.com“Presented under a dedicated 'SOC 2 Report' section on Lofty's security-compliance page, which states verbatim: 'A SOC 2 report is a report that service organizations receive and share with stakeholders to demonstrate that general IT controls are in place to secure the service provided.' Note: this is a generic description of a SOC 2 report under a section heading; the text does not name Lofty as the report holder, and no audit report or attestation letter is published.”
> Show 3 unconfirmed / not-held certifications
source: lofty.comType not specified in public documentation. Vendor states 'SOC 2 documentation' exists but does not clarify whether Type I or Type II audit.
source: lofty.comNo public evidence of HIPAA compliance. Real estate CRM is not a healthcare product; HIPAA not applicable or mentioned.
No public evidence of ISO 42001 AI governance certification despite heavy use of agentic AI features.
// Privacy & AI training
Trains on customer data
Not stated
Data processing agreement
Offered
Data region
United States (data collected, transferred to, and stored in US per section 3.9)
The privacy policy does not explicitly state whether customer data is used to train Lofty's agentic AI models, a significant gap. OpenAI is listed as an approved sub-processor, but the purpose and scope of data sharing are not clearly defined. Customer conversations and interactions involve AI agents, yet opt-out mechanisms and data minimization practices are not documented.
// Security controls
Employee Security Training
Security awareness training required for all employees on hire and annually
lofty.com// Products & data scope
Data it handles: Customer contact data, lead pipeline, communication history, property information
Purpose-built for real estate with agentic AI for autonomous lead engagement and follow-up. AI handles call prep, follow-ups, notes, and content creation.
Data it handles: Website visitor data, lead inquiry forms, property search behavior
Intelligent IDX system for lead generation and capture. Includes website customization and branding.
Data it handles: Customer contact lists, email engagement, marketing campaign performance
Automated 'Smart Plans' for lead nurturing across 33+ lead generation channels including Google PPC, Google LSA, local farming, and direct mail.
Data it handles: Conversation logs, lead interactions, scheduling, appointment booking, follow-up messaging
Autonomous AI agents trained on real estate conversation patterns. Handles appointment booking, lead filtering, and real-time guidance during calls. All AI actions are logged in CRM.
Data it handles: CRM data, lead information, communication history, property details
Full-featured mobile app for on-the-go access. Also includes Closely App, a separate mobile-optimized home search experience for clients.
Data it handles: Call logs, message history, contact records
Integrated calling and messaging from CRM with AI-enhanced call prep and follow-ups.
Data it handles: Transaction details, document management, deal pipeline
Manages the complete transaction lifecycle from lead to settlement.
// What to watch
- The privacy policy does not explicitly disclose whether customer data (conversations, lead interactions, call logs) is used to train Lofty's agentic AI models. OpenAI is listed as a sub-processor, but the data flow and training purpose are unclear. This matters because AI is a primary product feature.
- The vendor claims SOC 2 certification but does not specify Type I vs Type II. Type I covers the design of controls, while Type II covers their operation over a 6+ month period; these are substantively different assurance levels.
- Unlike many enterprise SaaS vendors, Lofty provides no public SOC 2 audit report, trust certificate, or third-party verification link. The certification claim is stated but not independently verifiable.
- 22 sub-processors are listed, including OpenAI, Google Cloud, AWS, and Zendesk; however, the scope and purpose of customer data shared with each is not clearly articulated in the DPA.
- Despite marketing agentic AI as a core feature and heavy use of AI agents for autonomous decision-making, Lofty holds no ISO 42001 AI governance certification. This gap may be relevant for enterprise buyers in regulated industries.
- While not a healthcare product, Lofty processes contact information, communication records, and lead data that could be sensitive for certain users; no Business Associate Agreement (BAA) option appears to be available.
- Data is stored exclusively in the US, with no option for EU data residency despite GDPR compliance claims. Organizations with data residency mandates cannot use Lofty.
// At a glance
Pricing model
Subscription-based SaaS; no public pricing listed; requires demo/sales inquiry; 'Smart Plans' available for agents, teams, and brokers
Self-hostable
No
// How we verified this
Every certification marked HELD is confirmed against a verbatim quote on Lofty Inc's own trust, security, or privacy pages. We reject certifications claimed only on third-party aggregators, on a cloud host's behalf, or by a similarly named company.
Last verified 2026-07-07. Compliance changes over time. Always confirm directly with the vendor before relying on any certification for a purchasing or compliance decision.
lofty.com