RA RAHome

Ai Governance & Trust

Ai Built for Scale.
Governed for Real-World Deployment.

34 governance controls. 28 fully implemented. Runtime enforcement, approval workflows, review queues, output scanning, endpoint allowlisting, provenance tracking, context isolation. While competitors ship uncontrolled Ai features and hope for the best, RA ships governed Ai systems with audit trails.

Request Governance Materials View FARE Act Compliance

Competitive Intelligence

Your Competitors Have Zero Ai Governance

CompanyAi SystemsGovernance ControlsRuntime EnforcementAudit TrailRegulatory Status
RealRiches12 production34 controls (28 implemented)Fail-closedImmutableClean — zero litigation
EliseAi EliseAi2None disclosedNoneNoneNo governance framework
RealPage RealPage1 (DOJ flagged)None (DOJ imposed monitor)NoneCourt-orderedUnder DOJ consent decree
AppFolio AppFolio1 (Realm-X)None disclosedNoneNoneNo governance framework
Yardi Yardi0NoneN/AN/A42yr codebase, no Ai
Zillow Zillow0 Ai systemsNoneN/AN/AUnder FTC antitrust suit
Entrata Entrata0NoneN/AN/ANo Ai, no governance

The $230M Lesson RealPage Learned Too Late

RealPage had ZERO governance controls on their pricing algorithm. The DOJ imposed a 3-year court-appointed monitor as a result. RA's governance stack was built BEFORE deployment, not after a $230M settlement forced it. This is the difference between proactive architecture and reactive compliance.

34-Control Framework

The 34-Control Framework

CategoryCountStatusMeaning
Implemented28Fully operational in the application layer
Infra-Ready2Code complete, awaiting infrastructure activation
Future ML2Platform prepared, ML engineering planned
N/A2Not applicable under current API-provider architecture

34 / 34 identified controls are addressed.

This does not mean every future capability is live. It means every identified control is either implemented, infrastructure-ready, future-ready, or correctly classified as N/A. No gaps. No unknowns. No overclaiming.

Implemented Controls

What Is Already Operational

Registry

Ai Governance Registry

Classifies all Ai services. Identifies shadow-Ai. Categorizes BYOAI. Distinguishes human vs machine API consumers.

No other PropTech platform even tracks which Ai services they are running.

Runtime

Runtime Enforcement

Fail-closed governance on every Ai action. Review requirements, output scanning, policy checks.

Governance is in the code path, not in a policy document.

Review

Approval Queue & Human Review

Approve, deny, defer flows. Queue semantics. Full audit trail.

Human-in-the-loop is not marketing language at RA. It is a reviewable execution framework.

Hardening

Hardening Controls

Endpoint allowlisting, provenance tracking, integrity verification, review-gate enforcement, heartbeat visibility, context isolation with TTL.

The same hardening discipline applied to defense and financial systems.

Closure

Closure & Readiness Layer

Every control classified with evidence. No overclaiming. Infra-pending and future-ML work explicitly separated from implemented controls.

Investors see exactly what is done, what is next, and what is not applicable — with evidence, not marketing.

Commercial Advantage

What This Enables Commercially

Enterprise

Enterprise Readiness

Enterprise buyers ask: "How do you govern your Ai?" AppFolio: "We have Realm-X." Yardi: "We do not use Ai." RealRiches: "34 controls, 28 implemented, runtime enforcement, immutable audit trail."

That is the difference between a product demo and a procurement win.

Monetization

Safer Premium Monetization

Governed Ai lets RA productize premium workflows ($149–$1,299 tiers) without creating uncontrolled platform risk.

Competitors cannot tier Ai features because they cannot control them.

Velocity

Faster Feature Rollout

New Ai features route through a common control layer. No one-off exception handling. No governance reviews per feature. The framework scales.

Diligence

Diligence Posture

Investors evaluate a real control model — not a slide deck claim. When due diligence asks "show me your Ai governance," RA produces 34 controls with evidence.

Competitors produce silence.

Remaining Work

What Remains — Transparent, Not Defensive

Remaining items are concentrated in infrastructure activation and future ML enhancement, not missing application-layer governance primitives.

Infra-Ready

Private inference posture: Network-private provider connectivity remains an infrastructure activation task.

SIEM connection: External security monitoring hookup remains a security operations task.

Future ML

Anomaly modeling: Broader model-based anomaly detection remains a future ML workstream.

Closed-loop feedback learning: Automated learning from approvals, denials, and workflow outcomes remains future ML work.

N/A — Current Architecture

Model artifact quarantine: Not applicable because RA uses API-based providers, not downloaded model files. No model artifacts to quarantine or scan.

The Moat

Governance Is Not a Checkbox.
It Is a Moat.

Building an Ai governance framework after deployment is 10x harder than building it before. RealPage learned this lesson at a cost of $230M and a 3-year court monitor. RA's governance was architected from the first line of code. The 34-control framework is not documentation — it is executable, testable, auditable code running in production. No competitor can retroactively add this to a shipping product without a complete architecture rewrite.

34
Controls
28
Implemented
0
DOJ Investigations
0
Governance Gaps
$230M
Saved (vs RealPage)

Investor Compliance Matrix

4 Regulatory Frameworks. Audited with Code Evidence.

Every control listed below was verified against production source code with file paths and line numbers. This is not a policy document — it is an engineering audit.

SOC 2 Controls

ControlStatusEvidence
CC6.1 — Logical AccessIMPLEMENTEDJWT auth on every route, rate limiting, CSRF protection.
CC6.2 — AuthenticationIMPLEMENTEDMFA (TOTP), argon2id hashing, account lockout (5 attempts/15min).
CC6.3 — RBACIMPLEMENTEDHierarchical roles, scoped permissions, default-deny engine.
CC6.6 — Encryption in TransitIMPLEMENTEDHSTS 1yr, CSP, X-Frame DENY, nosniff, secure cookies.
CC6.7 — Encryption at RestPARTIALAES-256-GCM for PCI, HIPAA encryption service. Field-level encryption middleware pending.
CC7.1 — Change ManagementIMPLEMENTED17/17 CI gates, Husky pre-commit, commitlint, frozen lockfile.
CC7.2 — Vulnerability MgmtIMPLEMENTEDSBOM (CycloneDX 5.6MB), gitleaks, eslint-plugin-security, dep-graph validator.

GDPR Controls

ArticleStatusEvidence
Art 5 — Data MinimizationIMPLEMENTEDExplicit select clauses, PII exclusion, data minimizer utility.
Art 6 — Lawful BasisIMPLEMENTED6 lawful bases tracked per processing operation. Consent manager with history.
Art 15 — Right of AccessIMPLEMENTEDData export endpoint collecting profile, leases, payments, documents, consent.
Art 17 — Right to ErasureIMPLEMENTED30-day grace period, email confirmation, scheduled deletion job.
Art 25 — Privacy by DesignIMPLEMENTEDhttpOnly cookies, Swagger disabled in prod, Permissions-Policy.

Fair Housing Controls

ControlStatusEvidence
Discriminatory ListingsIMPLEMENTEDProtected class detector (8 classes), semantic analyzer with proxy phrase detection, ad compliance checker.
Ai Steering PreventionIMPLEMENTEDFairScreen bias firewall, adversarial router, policy injection.
Source of IncomeIMPLEMENTEDSection 8 / voucher phrases flagged as PROHIBITED. Criminal background → disparate impact analysis per HUD 2016.
Reasonable AccommodationIMPLEMENTED7-state machine tracker, undue burden calculator, 10-day/30-day SLA, legal reference 42 USC §3604(f)(3)(B).

PCI-DSS Controls

RequirementStatusEvidence
No Raw Card DataIMPLEMENTEDHMAC-SHA256 tokenization, AES-256-GCM PAN encryption, CVV never stored. Stripe SDK for processing.
Secure TransmissionIMPLEMENTEDHSTS enforced, AES-256-GCM verified, Stripe TLS native.
Payment Data AccessIMPLEMENTEDPurpose-based detokenization, Stripe data redacted in logs, audit sanitization of all payment fields.
Payment Audit TrailIMPLEMENTEDGlobal audit plugin captures all payment mutations. Refund operations logged with Stripe refund ID.

837 Test Files. 32 E2E Specs. 17/17 CI Gates Green.

Every control above was verified against production source code with exact file paths and line numbers. The audit covered: auth plugins, privacy modules, payment routes, RBAC engine, PCI tokenization, GDPR consent management, fair housing Ai, and FairScreen ISP. Investors can verify every claim against the live codebase.

See How RealRiches Governs Ai at Platform Scale

For investors, enterprise buyers, and strategic partners.

Request Governance Materials View FARE Act Compliance