// Trust & Security Report
Redfin Corporation (a Rocket Companies, Inc. company)
"Redfin AI" refers to the AI-powered features built into the consumer real estate marketplace at redfin.com, not a standalone AI product or separate legal entity: Conversational Search (natural-language home search), Ask Redfin (generative-AI virtual assistant for listing Q&A), Redfin Redesign (AI photo redesign of walls/floors/countertops), and a Redfin app inside ChatGPT. All run on Redfin's consumer platform infrastructure. Redfin Corporation was acquired by Rocket Companies, Inc. (NASDAQ: RKT) on July 1, 2025.
Certifications held
0
Maturity
Enterprise
Trains on your data
Unknown
Trust center
No
// Certification ledger
Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.
> Show 8 unconfirmed / not-held certifications
source: redfin.comNo public evidence. redfin.com has no trust center or security page; the Privacy Policy and Terms of Use contain no reference to SOC 2.
source: redfin.comNo public evidence. No ISO 27001 (or 27017/27018/27701) reference found anywhere on redfin.com.
source: redfin.comNo public evidence of an AI-governance certification for the Conversational Search / Ask Redfin / Redfin Redesign AI features.
source: redfin.comNo public evidence, and out of scope: Redfin is a consumer real estate listing/search platform, not a HIPAA-covered entity or business associate handling PHI.
source: redfin.comNo public evidence. Redfin does not process card payments directly on the core consumer site in a way that is disclosed publicly; no PCI attestation is referenced.
source: redfin.com"If you are located in the European Economic Area, you have the right to lodge a complaint with a supervisory authority if you believe our processing of your Personal Information violates applicable law." — this acknowledges EEA data-subject rights but the policy stops short of an explicit GDPR-compliance claim, Article 27 EU representative, or DPIA process, so it is graded as a partial/unconfirmed posture rather than a held certification.
// Privacy & AI training
Trains on customer data
Not stated
Data processing agreement
Not offered
Data region
"Redfin is headquartered in the United States. You agree that we may store and process the information we collect anywhere in the world, including but not limited to, the United States." — no region-restricted or EU-data-residency option is offered.
The Redfin Privacy Policy contains no statement about whether user data (searches, photos, chat interactions with Ask Redfin / Conversational Search) is used to train Redfin's own AI models or third-party models. Given Redfin Redesign involves uploading personal home photos and Ask Redfin / Conversational Search involves conversational queries, this is a material gap for buyers evaluating the AI features specifically. No opt-out mechanism for AI training is disclosed.
// Security controls
Encryption in transit
Site is served over HTTPS/TLS (observed); no explicit written commitment to TLS for all data in transit found in the privacy policy.
redfin.comEncryption at rest
Only a narrow, specific claim: "Your Redfin account password is encrypted on our server." No broader at-rest encryption commitment (e.g., for photos, messages, or PII) is published.
redfin.comVulnerability/security disclosure program
No public bug bounty or responsible-disclosure page found on redfin.com at the time of this review.
redfin.comAccount deletion
"You may delete your Redfin account on your My Redfin: Account Settings page under 'Close Account' section."
redfin.comData retention
"Redfin retains the information we receive as described in this Privacy Policy for as long as you use our Services or as necessary to fulfill the purpose(s) for which it was collected..." — retention period is need-based, not fixed.
redfin.com// Products & data scope
data: User's natural-language search queries, browsing/search history, location.
Free consumer feature embedded in the main redfin.com site and app; no separate account tier or enterprise offering.
data: Listing data plus the user's questions; answers drawn from MLS/listing data, not from private user records.
Consumer-facing only, no B2B/API product identified in evidence.
data: User-uploaded photos of homes (walls, floors, countertops) processed by an AI image model.
Involves uploading personal property photos; no explicit retention/training disclosure for these images was found.
data: Query data passed through OpenAI's ChatGPT platform in addition to Redfin's own systems.
Introduces a second data processor (OpenAI) whose own security/compliance posture is not addressed in Redfin's privacy policy.
// What to watch
- Identity note: "Redfin AI" is not a distinct company or product SKU — it is a set of AI features (Conversational Search, Ask Redfin, Redfin Redesign, ChatGPT app) inside the consumer site redfin.com, operated by Redfin Corporation. Any listing should make clear this is a feature set of the larger Redfin platform, not an independent AI vendor.
- No public trust center, SOC 2, ISO 27001, or AI-governance (ISO 42001 / CSA STAR) certification found anywhere on redfin.com despite Redfin being a large, formerly-public (NASDAQ: RDFN) company now owned by Rocket Companies (NASDAQ: RKT). This is a genuine gap for a company of this scale, not just a startup-style absence, and should be flagged rather than assumed benign.
- Redfin was acquired by Rocket Companies, Inc. on July 1, 2025. Any certifications Rocket Companies or Rocket Mortgage hold belong to the parent/host, not confirmed as extending to redfin.com or its AI features; do not attribute Rocket's compliance posture to Redfin without direct vendor-domain proof.
- No disclosure of whether Ask Redfin / Conversational Search / Redfin Redesign use customer inputs (queries, uploaded photos) to train AI models, and no opt-out mechanism found. This is a material gap given personal photos are uploaded for Redfin Redesign.
- Redfin app in ChatGPT introduces OpenAI as an additional data processor not addressed in Redfin's own privacy policy.
- GDPR posture is only partially confirmed: EEA complaint rights are acknowledged, but no explicit GDPR-compliance claim, DPA availability, or EU representative was found.
// At a glance
Pricing model
Free to consumers (Redfin's revenue comes from real-estate brokerage commissions and Rocket Mortgage lead referrals, not from the AI features themselves)
Self-hostable
No
// How we verified this
Every certification marked HELD is confirmed against a verbatim quote on Redfin Corporation (a Rocket Companies, Inc. company)'s own trust, security, or privacy pages. We reject certifications claimed only on third-party aggregators, on a cloud host's behalf, or by a similarly named company.
Last verified 2026-07-08. Compliance changes over time. Always confirm directly with the vendor before relying on any certification for a purchasing or compliance decision.
redfin.com