Real Estate Investing Platform

ScaleSec began by gathering information about the types of data collected, what the data was used for, and how and for how long it was stored, transmitted, shared, and deleted. Concurrently, the customer developed a list of all current US states of operation, as well as those states targeted for expansion through 2025. Given various sources and means of gathering information (direct from consumer, financial institutions, publicly available data), assessment, storage, and transmission of data was complicated and difficult to categorize.

Once ScaleSec understood the data content and how it was managed, ScaleSec reviewed the company’s existing compliance programs (policies, procedures, frameworks) against the thousands of separate state-level privacy requirements within the US. Using a state-by-state approach, ScaleSec identified which of these many laws would serve as the national baseline for each area of data protection. These functional areas included such topics as encryption, data access/deletion rights, data retention, third party transmission and storage, and logging/monitoring requirements. When ScaleSec understood how the compiled requirements related to the customer’s business model and architecture, current security programs were evaluated for compliance.

The final report provided guidance to ensure data privacy compliance under all applicable state and federal laws, including a one-page summary that gave clear, concise steps needed to reach compliance. The report also provided a state-by-state review, making it easier to understand the impact of adding or subtracting geographical service areas and markets.