CRE FuelTrust & Security
Written for a vendor security review. This page separates what CRE Fuel does itself, what the underlying platform provides, which other providers are involved, and what is not verified.
- How to read this
- Architecture
- Control history
- What CRE Fuel does
- AI processing
- What HighLevel provides
- Other providers
- Retention and deletion
- Not verified or not available
- Contact
How to read this page
CRE Fuel is a solo-founder product built on HighLevel's CRM platform. We have been exact about who does what, because the difference matters in a review.
| Label | Meaning |
|---|---|
| CRE Fuel | Implemented in CRE Fuel's own code and verifiable in the product |
| HighLevel | Provided by the underlying platform. Not a CRE Fuel control or certification |
| Third party | Provided by another named vendor |
| Not verified | We cannot confirm it, or it does not exist |
Architecture
CRE Fuel is a hosted web application at app.crefuel.co, acting as a workflow and presentation layer over HighLevel. There is no self-hosted or on-premise component.
Core CRM records are maintained in the brokerage's HighLevel account. CRE Fuel also uses a limited number of providers for application hosting, operational storage, communications, optional AI features, billing, and other documented functions, all listed below.
CRE Fuel does not store customer business records on machines owned by CRE Fuel or its founder. This was checked in an internal code review in July 2026. It is our own review, not an independent audit.
Control history
This page was written for a customer security review. The page is new. The controls below were added over time.
| Shipped | Control |
|---|---|
| May 2026 | Authentication gate on API endpoints (internal ref SEC-1) |
| May 2026 | Signature verification on inbound telephony webhooks (SEC-4) |
| May 2026 | Server-side fencing of platform API tokens |
| July 2026 | Encryption of stored integration credentials (SEC-2) |
| July 2026 | One-way scrypt password hashing |
| July 2026 | Internal review confirming no business records on local disk |
| August 2026 | Rate limiting and lockout, browser security headers, published security contact |
SEC- references come from our own development process. They are not an external audit.
What CRE Fuel does itself
| Control | Implementation |
|---|---|
| Password storage | One-way scrypt hash, per-user random salt, constant-time comparison |
| Password change | Single-use, time-limited link sent to the account email address. No in-app change form |
| Session | HMAC-SHA256 signed cookie, httpOnly, Secure, SameSite=Lax, re-verified per request |
| Sign in with Google | OpenID Connect. Scopes openid email profile only. No mail, calendar or contacts access |
| Brute-force protection | Rate limiting on sign-in and password-reset endpoints, plus a stored lockout after repeated failures |
| Telephony webhooks | Cryptographic signature from the phone provider verified before processing |
| Stored credentials | Integration credentials encrypted at rest using AES-256-GCM |
| Token exposure | Platform API tokens fenced to server-side execution at build time |
| Permissions | Role limits applied at the API layer, not by hiding interface elements |
| Browser security headers | HSTS, nosniff, X-Frame-Options, frame-ancestors, Referrer-Policy, Permissions-Policy. Verifiable with a request to app.crefuel.co |
AI processing
Smart Inbox and Drift analysis are initiated when an authenticated user chooses to run the applicable AI feature. Call-summary processing occurs after a broker has enabled call recording.
The two AI-assisted dashboard views populate from non-AI data sources on load. The server refuses AI analysis requests that do not carry an authenticated, user-initiated action, so page loads, refreshes, background revalidation and route changes do not trigger AI processing.
Other AI features in the product are invoked by an explicit user action.
Call recording and transcription
If a broker enables call recording, audio is stored in that brokerage's own phone provider account. A transcription provider produces text, which is passed to an AI provider to produce a written summary. The summary is saved to the contact record.
CRE Fuel does not retain raw call transcripts after processing. A written call summary may be saved to the relevant contact record.
CRE Fuel does not make claims about what its providers retain. Review each provider's documentation.
Operational logs
CRE Fuel maintains operational logs for reliability and troubleshooting. The product has been updated to reduce customer email addresses and phone numbers in those logs. Additional review of other potentially sensitive business information in logs is ongoing.
Document uploads
Documents uploaded to a deal or property are transferred through CRE Fuel's hosting provider and then stored in the brokerage's account on the underlying platform. CRE Fuel is designed to delete the temporary staging copy after a successful transfer.
Email and attachments
CRE Fuel does not support uploading or attaching documents to emails sent directly through the application. Emails sent by CRE Fuel may contain links.
When a user chooses to compose through a connected Outlook or Gmail account, CRE Fuel opens the user's Outlook or Gmail platform, and any attachment is selected, attached, and sent within that provider's platform under that provider's policies.
Email history is retained in the underlying platform. It is not currently available as a user-facing export in CRE Fuel.
Data portability
Contacts can be exported as CSV files through the Contacts page, using selected columns and active filters, or through Settings using the available standard export. Commission records can be exported separately as CSV files.
Certain additional records are maintained in the underlying platform. Availability of self-service export screens inside that platform depends on record type and user permissions, and should be confirmed against that platform's documentation.
What HighLevel provides
The following are HighLevel's controls, described in HighLevel's own documentation. They are not CRE Fuel controls, and CRE Fuel does not inherit them.
HighLevel states that it:
- has achieved SOC 2 Type II accreditation covering Security, Confidentiality, and Availability
- lists an ISO/IEC 27001:2022 certificate in its trust centre
- maintains EU–U.S. Data Privacy Framework certification
- encrypts data at rest using AES-256, and in transit using TLS 1.2 or 1.3
- hosts infrastructure on Google Cloud and AWS in the United States
- commissions annual penetration testing and ongoing vulnerability scanning
- requires two-factor authentication and role-based access for its own staff
Each brokerage using CRE Fuel has its own separate HighLevel sub-account. Separation between customers is provided by HighLevel's sub-account model.
For any question about HighLevel's infrastructure, backups, retention, breach response, or audit scope, please review HighLevel's published documentation below or contact HighLevel. We will not guess at answers about a platform we do not operate.
Underlying Platform Documentation
CRE Fuel is built on HighLevel's underlying CRM platform. HighLevel publishes documentation describing the security and compliance practices applicable to its platform. Those materials belong to HighLevel and do not constitute a separate CRE Fuel certification, audit, or compliance attestation.
- HighLevel Data Privacy & Security
https://www.gohighlevel.com/privacy-and-security - HighLevel Security and Compliance Overview
https://help.gohighlevel.com/support/solutions/articles/155000000574-highlevel-security-and-compliance-overview - HighLevel SOC 2 Type II information
https://help.gohighlevel.com/support/solutions/articles/155000007495-highlevel-achieves-soc-2-type-ii-certification
Other providers
The providers below are those involved in documented CRE Fuel workflows. CRE Fuel does not independently attest to third-party provider certifications. The provider documentation should be reviewed for the current scope and status of its security and compliance materials.
| Provider | Function | Documentation |
|---|---|---|
| Vercel | Application hosting and limited operational storage. This includes temporary staging of documents during upload, plus limited application indexes and optional integration data needed to operate CRE Fuel. | security.vercel.com |
| Anthropic | Optional AI features. Depending on the feature used, content provided to those features may include contact records, notes, communications, deal or property documents, commission information, and call transcripts. | trust.anthropic.com |
| Twilio | Voice and text transport. Call recordings when a broker enables recording | twilio.com/en-us/legal/security |
| Deepgram | Call transcription, only when recording is enabled | deepgram.com/data-security |
| Stripe | Subscription billing. CRE Fuel does not receive or store full card numbers | stripe.com/privacy |
| Resend | Transactional email such as sign-in and password links | resend.com/security/soc-2 |
| Cloudflare | DNS, marketing site, inbound email routing | cloudflare.com/trust-hub |
| Mojo Dialer (optional) | Used under the broker's own Mojo account | mojosells.com/privacy-policy |
Resend publishes a SOC 2 Type II attestation, and Deepgram publishes SOC 2 Type II and HIPAA BAA availability, both verified from their own documentation linked above. For all other providers, see the provider's published trust, security, and compliance documentation.
Retention and deletion
CRE Fuel does not currently publish a standalone retention or deletion policy.
CRE Fuel uses limited operational storage through its hosting provider, including certain contact indexes and optional connector data. A documented offboarding cleanup process is being implemented for that operational storage. Until it is complete and tested, CRE Fuel does not promise a deletion timeline.
Not verified, not available, or planned
| Item | Status |
|---|---|
| CRE Fuel SOC 2 report | Does not exist |
| CRE Fuel ISO 27001 certificate | Does not exist |
| CRE Fuel penetration test | Never performed |
| Independent verification of CRE Fuel's own controls | None |
| Standalone backup, retention, deletion, or uptime policy | Not published |
| Complete account export | Not built |
| Export of notes, messages, deals, tasks, properties, or documents through the CRE Fuel interface | Not built |
| SAML single sign-on | Not supported |
| SCIM user provisioning | Not supported |
| Customer-managed encryption keys | Not supported |
| Full script-level Content-Security-Policy | Not implemented |
Vulnerability disclosure
Security contact: security@crefuel.co, also published at app.crefuel.co/.well-known/security.txt.
We will not pursue anyone who reports a genuine issue in good faith and gives us a reasonable window to fix it.
Questions
If your IT team has specific questions after reviewing these materials, please send them to security@crefuel.co. We will review a security questionnaire, provide the verified information we have, and share the appropriate provider documentation where a question relates to the underlying platform.