What should a real estate CFO check before approving an AI tool?

Independent assurance (SOC 2 Type II, ISO/IEC 27001), a contractual no-training commitment, data residency, customer isolation, access controls, audit logs, subprocessors and model providers, deletion on exit, and breach notification terms.

Is SOC 2 Type II enough on its own?

No. Check the report's scope and period, and ask AI-specific questions about model training, model providers and source tracing that a SOC 2 report may not answer.

Do AI vendors train models on our data?

Terms vary by plan; some consumer plans allow training by default, while business and enterprise terms typically exclude it. Check the current terms. Get the commitment in your contract, and make sure it covers the vendor's model providers too.

What is ISO/IEC 42001?

An international standard for AI management systems, published in December 2023. It is relatively new, so treat it as a positive signal rather than a requirement.

How do we stop analysts using personal ChatGPT accounts for deal documents?

Approve a tool that meets the checklist, publish a short data policy, and make the approved tool easier to use than the personal one.

Does Fifth Dimension use customer data to train models?

No. Customer data remains private and is never used to train the models that power Fifth Dimension.

All resources

Blog

AI vendor security checklist for real estate CFOs

by Robin Langdon, Field CTO, APAC1 October 2026

What a real estate CFO should check before approving an AI tool for confidential fund and tenant data: 44 questions on certifications, data use and access.

Guide cover reading “Security checklist”: AI vendor security checklist for real estate CFOs

Short answer

Before approving an AI tool for fund, deal or tenant data, a real estate CFO should confirm six things in writing: independent security assurance (a current SOC 2 Type II report and ISO/IEC 27001 certificate, with scope); that your data is never used to train models; where data is stored and processed; how your data is isolated from other customers; who can access it, including identity, role and network controls; and that every action is logged and data can be deleted on exit. Then check the AI-specific risks: which model providers are used, how answers are traced to sources, and how permissions carry over to AI outputs.

This checklist is general guidance, not legal or audit advice. Confirm requirements with your counsel, auditors and compliance team.

Why AI tools need their own security review

Analysts already use AI. The risk usually isn't the tool a firm approves, it's the personal accounts used in its place, where data terms are set by a consumer plan rather than your contract. A fast, clear approval process is a security control in itself. AI tools also raise questions a standard SaaS review may miss: whether prompts and documents train a model, which third-party model providers see your data, and whether AI answers can surface documents to people who shouldn't see them.

The checklist

1. Independent assurance

Current SOC 2 Type II report, its period covered and its scope (which systems and products are in it)
ISO/IEC 27001 certificate: issuing body, scope and expiry date
Bridge letter if the SOC 2 period ended more than a few months ago
Penetration test summary from the last 12 months
Any AI management certification such as ISO/IEC 42001 (optional; published December 2023 and still not universal among AI vendors)

2. Data use and model training

Written commitment that your documents, prompts and outputs are never used to train models, in the contract, not just on a web page
Same commitment covering any third-party model providers the vendor uses
Clear statement of any human review of your data by the vendor, and under what conditions

3. Data location and residency

Where data is stored and processed, by region
Whether EU data stays in the EU and US data in the US, if that matters to your funds or investors
On-premise or private deployment options if your policy requires them

4. Isolation between customers

Separate environment or logical isolation per customer
How the vendor prevents one customer's data appearing in another's results

5. Access and identity

SAML single sign-on with your identity provider
Role-based access so people see only the deals, funds and assets they should
IP allow-listing or network restrictions
MFA enforced for any non-SSO access
User provisioning and deprovisioning process (SCIM or equivalent)
Does AI respect existing document permissions, or can an answer surface a file the user couldn't open?

6. Logging and audit

Every user and system action logged and exportable
AI answers traceable to the source documents used
Log retention period meets your audit requirements

7. Encryption and infrastructure

Encryption in transit and at rest; key management approach
Hosting provider and region
Backup, recovery point and recovery time objectives

8. Subprocessors and model providers

Published subprocessor list with a last-updated date
Which AI model providers are used, for what, and under what data terms
Notice period before new subprocessors are added

9. Data lifecycle and exit

Retention controls you can set
Deletion on request and on contract end, with written confirmation
Export of your data and outputs in usable formats

10. Incidents, availability and contract

Breach notification commitment in hours, in the contract
Service level agreement with uptime and support response times
Data processing agreement aligned to GDPR where relevant
Liability and cyber insurance levels appropriate to the data
Information security and acceptable use policies, with dates

11. AI-specific risks

How prompt injection and harmful content are handled
Whether outputs cite sources so reviewers can check them
How you can verify outputs on your own document types (citations, review steps, sign-off)
Human review steps for outputs that feed valuations, investor reporting or accounting
Alignment with an AI risk framework such as the NIST AI RMF

12. Rollout

A named internal owner and an approved-tools list
A short policy on what data may go into which tool
A plan to move analysts off personal AI accounts

Standards referenced (with dates)

SOC 2: AICPA Trust Services Criteria (opens in a new tab) (2017, with revised points of focus in 2022).
ISO/IEC 27001:2022: information security management systems (opens in a new tab), published October 2022.
ISO/IEC 42001:2023: AI management systems (opens in a new tab), published December 2023.
NIST AI Risk Management Framework 1.0: released January 2023 (opens in a new tab).
GDPR: Regulation (EU) 2016/679 (opens in a new tab), applicable since 25 May 2018.
EU AI Act: Regulation (EU) 2024/1689 (opens in a new tab), entered into force 1 August 2024, with obligations phasing in from 2025.

Is it safe to upload deal documents to ChatGPT or Copilot?

It depends on the plan, not just the product. Business and enterprise plans often include contractual data-protection terms that consumer plans may not; check each provider's current terms. For example, Microsoft states that under enterprise data protection, prompts, responses and Microsoft Graph data aren't used to train foundation models (Microsoft Learn (opens in a new tab), page dated May 2026, updated August 2026). Run any tool through the checklist above, and check the exact plan your analysts are using. For a fuller comparison, see Microsoft Copilot or a specialist AI tool for real estate investment teams.

How Fifth Dimension answers this checklist

From Fifth Dimension's security page and Trust Center:

Checklist area	Fifth Dimension
Independent assurance	SOC 2 Type II compliant. ISO 27001 certified.
Data use and training	Customer data remains private and is never used to train the models that power Fifth Dimension.
Data residency	Customer data is kept within the region agreed for your deployment: EU data stays in the EU and US data in the US. GDPR compliant.
Deployment	On-premise deployment available for firms that require on-premise or air-gapped environments.
Isolation	Each customer operates in a separate product environment, with no data cross-pollination between clients.
Access and identity	SAML SSO and role-based access. IP allow-listing.
Logging and audit	Every operation is logged and traceable.
Data lifecycle	Data lifecycle management: agreed controls for how customer data is retained and removed.
Policies	The Trust Center publishes a Subprocessor list, Acceptable Use Policy, Information Security Policy and Service Level Agreement, each with its last-updated date.
Model providers	Works with multiple AI models.
Source tracing	Evidence & Controls keeps sources, assumptions, review steps and changes visible.
Connected systems and permissions	Integrates with SharePoint and Yardi. Box and Egnyte sync with access permissions mirrored; Microsoft 365 and Google connectors use each person's own sign-in.

Penetration testing, breach notification terms, MFA, SCIM and our model providers aren't on our public site. Ask us about them; some details are shared under NDA.

Talk to us