Flueid: Real Estate Verification of Title Software

If We’re Going to Accelerate the Digitization of Consumer Data, We Have a Responsibility to Protect It

By Ryan Jaeger, CIO & CISO of Flueid

In their recent blog, When Worlds Collide: Bringing the Tech Revolution to Real Estate, Flueid co-founders Peter Bowman and Peter Richter discuss their journey bringing the real estate transaction online. Every step toward increased integration is taken with the vision of supporting our clients in delivering an on-demand customer experience aligned to the expectations of today’s society by providing industry players with immediate certainty in their decision-making.

There is something else consumers are learning to demand, however: That their data is continuously protected.

Credit Apple’s Tim Cook with giving this notion traction. Consumers hungrily began adopting technology that allowed companies to access more and more of their data, and thus unwittingly (at the time) leaving their footprints in a digital sea with lots of fishermen – like data brokers and thieves. Cook’s steadfast and previously unwavering battles (more on that later) brought the issue to light, most famously with his 2015 refusal to allow a “back door” entry into the iPhone data of a suspected shooter.

That’s when it began to dawn on consumers that maybe they should be more concerned about their data and privacy and the onus fell to those controlling it to keep them safe. The health care industry has been doing it with HIPAA (Health Insurance Portability and Accountability Act) for around two decades now. And until recently Tim Cook was doing it for an estimated 1 billion-plus iPhone users around the world.

Apple’s August 2021 announcement that it is compromising its end-to-end encryption in iCloud and iMessage to protect children is a meaningful and well-intentioned promise. However, it is a complete shift from his steadfast disapproval of back doors not long ago. It also has the real potential to introduce risk to all of our systems in the hands of one malicious user.

So now we are all faced with a question: If global giants succumb to pressures and change their standards, what’s acceptable and best practice for the rest of us when it comes to protecting consumer data?

The answer: leave the data with the entity of the consumer’s choosing, and only with that entity. Period.

We grew up and applied lessons learned

Back in the days reflected in that first blog (circa mid-to-late 90s), it was all about the data. Gathering it. Synthesizing it. Creating insights that could help businesses better understand their customers.

Now we are living in the era of data protection and those same 2015 standards should apply to both consumer tech and business solutions. It is about building an architecture that allows each vendor’s data to be unique and remain in a siloed environment, with no cross-pollination

We saw that opportunity to build that up and apply the concepts we learned over the last 20 years to an industry filled with data and ripe for innovation. That’s why we focused on building Flueid with data security and privacy at our core. We put thought into the architecture and design to ensure it would support the control framework that allows our clients to manage their own data (the consumer’s data) in a controlled way. Our multi-tenant environment allows us to do that. In the process, we are empowering an approach the industry has been asking for over the last eight years and modernizing it to protect consumers’ data and interests.

Transparency and control

When we embarked on our Flueid journey, protecting data became a priority for us because we felt it defined us as a company. If we’re touching personal, private data, we needed to be trusted by our clients to ensure their client’s data is protected.

Long gone are the days of the little black box. It’s about empowering customers to control their data by putting the proper controls in place, and making sure anyone downstream also handles the data appropriately right from the start of an engagement.

We felt the best way to earn that trust was to not only build the platform with data security at the core, but have those practices verified. That’s why we underwent the SOC (SOC for Service Examinations: Trust Services Criteria) Type 1 and Type 2 examinations, a process that normally takes companies two to three years. Flueid achieved compliance in nine months, and partnered with a large, international accounting firm to verify our controls.

We were able to aggressively accelerate this control framework because that was our objective as we built it – we didn’t inherit a product that wasn’t built to be compliant, we built one with that compliance in mind. Moreover, we built it as a model of continuous compliance, with automated controls in place that prevents the user from working out of the control framework.

This is also pushing the audit industry forward. We built an automated system that is predictable and repeatable, with complete transparency and tight control. It reports on itself versus having a human in the loop with checks and balances. The data stays with each vendor behind their firewalls, in their protected environments, and our control framework notifies clients of anything we do to data in their environments.

The Type 1 audit is performed one time to show you have the appropriate controls. Our SOC 2 Type 2 audit ensures vendors are following best practices without them having to put a great deal of thought and energy into the proofing. This is an annual audit to demonstrate continued operational effectiveness as organizations change, use new products, etc., to make sure both existing and new services and innovations are following the same framework.

Follow the leader

We understand it’s a multi-year and multi-million-dollar investment to complete a re-architecture. But companies should at least begin moving in that direction. And more importantly, clients should be demanding it – whether they are an individual consumer or a multi-billion-dollar financial institution.

We understand the clients’ concern over their own data, which is why we modernized the approach to ensure customers’ data stays where it’s intended and not shared without knowledge and control. We believe other architectures should be modeled to do that. That’s our challenge to the industry.

Consumers admire privacy champions and have a way of forcing technology innovation with purchase and consumption shifts. The rewards will go to the privacy forerunners.