Date: 2026-07-26
Auditor: Base44 AI Legal Risk Analysis
Classification: CONFIDENTIAL — ATTORNEY REVIEW REQUIRED
Status: PHASE 1 COMPLETE — FACTUAL BLUEPRINT FOR PHASE 2 LEGAL BUILDOUT
CRITICAL DIRECTIVE: This audit identifies legal exposures based on actual system behavior, not aspirational documentation. Every finding is based on source-code review of the live application. Where existing legal language exists but does not match system behavior, it is flagged as a LEGAL/PRODUCT CONTRADICTION. This audit does NOT draft legal documents. It builds the factual blueprint needed for Phase 2.
Houszu operates as a multi-role real estate technology platform that simultaneously functions as:
The core legal vulnerability: Houszu performs all of these roles under a single, generic Terms of Service and Privacy Policy that do not address the specific legal obligations of each role. There is no agent participation agreement, no lead acceptance agreement, no vendor marketplace agreement, no referral fee agreement, and no AI services disclosure. Critical legal actions (account creation, checkout, lead acceptance, territory purchase, vendor registration) rely on browsewrap acceptance with no affirmative consent mechanism.
Overall Legal Defensibility Score: 31/100 (see §20 for breakdown)
EstateSalen functions as:
The core legal vulnerability: EstateSalen has no dedicated legal terms whatsoever. It shares Houszu's generic Terms of Service, which contain no provisions addressing: authority to sell estate items, executor/heir disputes, counterfeit merchandise, prohibited goods, cash handling, liability for unsold inventory, or reseller obligations. The platform handles estate sale inventory — which carries unique legal risks around ownership authority, authenticity, and prohibited items — with zero specific legal coverage.
Overall Legal Defensibility Score: 14/100 (see §20 for breakdown)
Both platforms share:
| # | Finding | Severity | Likelihood | Financial | Regulatory | Reputational | Litigation | |---|---------|----------|------------|-----------|-------------|--------------|------------| | 1 | No lead acceptance agreement — agents receive leads with zero contractual obligation to pay referral fees | CRITICAL | 5 | 5 | 4 | 3 | 5 | | 2 | No Terms of Service checkbox at registration — browsewrap only | CRITICAL | 5 | 4 | 4 | 2 | 5 | | 3 | No consent capture for SMS/email marketing — TCPA/CAN-SPAM exposure | CRITICAL | 5 | 5 | 5 | 3 | 5 | | 4 | 2X Results Guarantee with no enforceable qualification terms | CRITICAL | 4 | 5 | 3 | 4 | 5 | | 5 | Referral compensation to potentially unlicensed persons | CRITICAL | 4 | 4 | 5 | 3 | 4 | | 6 | No vendor marketplace agreement — marketplace liability with no provider representations | CRITICAL | 4 | 4 | 3 | 4 | 5 | | 7 | No estate sale company agreement — authority to sell, liability gaps | CRITICAL | 3 | 5 | 4 | 4 | 5 | | 8 | No call recording/transcription consent — state two-party consent laws | HIGH | 4 | 4 | 5 | 3 | 4 | | 9 | No legal document versioning — cannot prove what version user agreed to | HIGH | 5 | 4 | 3 | 2 | 5 | | 10 | No legal acceptance ledger — no evidence of acceptance for any transaction | HIGH | 5 | 4 | 3 | 2 | 5 | | 11 | AI provides valuation/pricing advice without disclaimers at point of output | HIGH | 5 | 3 | 3 | 3 | 4 | | 12 | No fair housing audit of AI matching/scoring algorithms | HIGH | 3 | 3 | 5 | 5 | 4 | | 13 | No cancellation confirmation/acceptance — auto-renewal dispute risk | HIGH | 4 | 4 | 3 | 2 | 4 | | 14 | Territory "ownership" language may create unintended property rights | HIGH | 3 | 4 | 3 | 2 | 4 | | 15 | No indemnification from agents/vendors/partners | HIGH | 4 | 4 | 2 | 2 | 5 | | 16 | Privacy Policy does not match actual data practices | HIGH | 4 | 3 | 4 | 4 | 3 | | 17 | No separate consent for call recording / AI live coaching | HIGH | 4 | 3 | 5 | 3 | 4 | | 18 | No FSBO/hybrid services disclosure distinguishing services from brokerage | HIGH | 3 | 3 | 4 | 3 | 4 | | 19 | No investor/cash offer disclosure distinguishing offers from market value | HIGH | 3 | 4 | 3 | 3 | 4 | | 20 | No IP protection — scraping, resale, reverse engineering not addressed | MEDIUM | 4 | 3 | 2 | 2 | 4 | | 21 | No complaint/trust & safety case management system | MEDIUM | 4 | 3 | 3 | 4 | 3 | | 22 | No legal hold capability | MEDIUM | 3 | 3 | 3 | 2 | 4 | | 23 | No accessibility statement or WCAG compliance audit | MEDIUM | 3 | 2 | 3 | 3 | 3 | | 24 | No data retention enforcement on AI conversations/transcripts | MEDIUM | 3 | 2 | 3 | 3 | 3 | | 25 | No acceptable use policy enforcement mechanism | MEDIUM | 3 | 2 | 2 | 2 | 3 |
(Must be addressed before increased public usage)
System Behavior: Agents receive leads via base44.entities.Contact.list(), Lead.filter(), or assignment. There is no acceptance step, no agreement to referral terms, and no acknowledgment before an agent views or contacts a lead. The leadCapture function creates Contact/Lead records with is_houszu_generated: true, but no mechanism requires the agent to accept referral fee obligations before accessing Houszu-generated leads.
Legal Exposure: Without a signed or clickwrap lead acceptance agreement, Houszu cannot enforce referral fee obligations. An agent who receives a Houszu-generated lead can close the transaction and deny any obligation to pay. Houszu has no contractual basis to sue for the referral fee.
Evidence Gap: No record of what the agent agreed to before receiving the lead. No timestamp, no IP, no agreement version.
System Behavior: Registration page (/register) creates an account with no Terms of Service checkbox and no Privacy Policy checkbox. The Terms of Service state "By creating an account or using the Platform, you agree to these Terms" — this is browsewrap, which courts routinely find unenforceable for material terms.
Legal Exposure: Without affirmative acceptance (clickwrap), arbitration clauses, limitation of liability, and indemnification provisions may be unenforceable. All consequential legal protections depend on this foundational acceptance.
System Behavior: The leadCapture function sets opt_in_status: email ? 'opted_in' : 'pending' — merely providing an email address is treated as opt-in. There is no consent language displayed, no checkbox, no disclosure of SMS/email marketing. The Contact entity has communication_preferences and opt_in_status fields, but no UI captures affirmative consent. CustomerIO sync automation fires on Contact creation, enrolling contacts in marketing campaigns.
Legal Exposure: TCPA (SMS), CAN-SPAM (email), and state-level communication laws require affirmative consent for marketing communications. Treating email provision as opt-in is insufficient. Class-action TCPA exposure for automated SMS is severe ($500–$1,500 per violation).
System Behavior: The AI Marketing Department landing page (/ai-marketing-department) prominently displays: "Double Your Investment in Commission Within 6 Months — Or Your Next 6 Months Are Free." The config (aiMarketingDepartmentConfig.js) defines the guarantee parameters, but there is no user-facing agreement specifying:
Legal Exposure: A guarantee without defined terms is interpreted against the drafter. An agent who pays $497/mo for 6 months ($2,982) and earns any commission can argue they're owed 6 free months. Without clear attribution definitions, any commission could be claimed.
System Behavior: The revenueEngine, brokerCompensationEngine, and partnerWalletEngine functions process referral fees, commission splits, and wallet credits. The CommissionTransaction entity records splits between referring agents, success partners, territory partners, and corporate. However, there is no referral fee agreement that:
Legal Exposure: In many states, paying referral fees to unlicensed persons is illegal. The platform routes compensation through multiple parties without verifying licensing. Without a signed referral agreement, fee obligations are unenforceable, and paying unlicensed persons creates regulatory liability.
| Scenario | Potential Plaintiff | Likely Allegation | Platform | Severity | Current Protection | Missing Protection | Recommended Action | |----------|-------------------|-------------------|----------|----------|-------------------|-------------------|-------------------| | Agent receives lead, closes deal, refuses to pay referral fee | Houszu | Breach of implied referral agreement | Houszu | CRITICAL | None — no written agreement | Lead acceptance agreement with clickwrap consent before lead access | Implement lead acceptance clickwrap + ledger | | Consumer texts "STOP" but continues receiving marketing SMS | Consumer | TCPA violation ($500–$1,500/message) | Houszu | CRITICAL | CustomerIO processes opt-outs | No proof of consent, no suppression evidence | Implement consent capture + suppression logging | | Vendor damages property during job referred through Houszu | Homeowner | Negligent referral, vicarious liability | Houszu | CRITICAL | None — no vendor agreement | Vendor marketplace agreement, independent contractor disclaimer, insurance requirement | Implement vendor agreement + insurance verification | | Agent claims guarantee applies to all commission earned | Agent | Breach of guarantee, misrepresentation | Houszu | CRITICAL | Config defines terms internally | No user-facing guarantee agreement with defined terms | Implement guarantee agreement at checkout | | Estate sale company sells items without authority from rightful heir | Heir | Conversion, unauthorized sale, aiding and abetting | EstateSalen | CRITICAL | None | Authority-to-sell representation, estate sale agreement | Implement authority representation + agreement | | AI valuation tool estimates $500K; home sells for $400K | Seller | Negligent misrepresentation, reliance damages | Houszu | HIGH | Generic disclaimer in Terms | Point-of-output disclaimer, "not an appraisal" notice | Add disclaimers at every valuation output | | Call recording without two-party consent in CA, FL, IL | Consumer | Wiretapping statute violation | Houszu | HIGH | None | Call recording consent, jurisdictional notice | Implement consent capture before recording | | Agent changes brokerage, takes leads to new company | Houszu | Tortious interference, breach | Houszu | HIGH | None | Brokerage change provisions, non-circumvention | Add to lead acceptance agreement | | Consumer claims AI matching algorithm discriminated by race | Consumer / HUD | Fair Housing Act violation | Houszu | HIGH | None | Fair housing audit, algorithm documentation | Implement fair housing impact testing | | User cancels subscription but continues to be billed | Consumer / AG | UDAP violation, dark pattern | Houszu | HIGH | Cancel function exists | No cancellation confirmation, no evidence | Implement cancellation clickwrap + confirmation | | Investor offer presented as "fair market value" | Seller | Misrepresentation | Houszu | HIGH | None | Clear distinction between offer/estimate/market value | Add disclosure language at offer presentation | | User uploads copyrighted photos, copyright holder sues | Copyright holder | Contributory infringement | Houszu/EstateSalen | MEDIUM | Generic UGC clause | DMCA takedown procedure, repeat infringer policy | Implement takedown process | | Vendor claims territory exclusivity was promised | Vendor | Breach of contract, promissory estoppel | Houszu | MEDIUM | Territory entity exists | Territory participation agreement with defined terms | Implement territory agreement | | AI-generated marketing contains Fair Housing violation | Consumer / HUD | Discriminatory advertising | Houszu | MEDIUM | Agent prompt-injection defense | Output review, fair housing filter on AI content | Add FH review step to AI marketing output | | Estate sale buyer claims counterfeit item | Buyer | Fraud, breach of warranty | EstateSalen | MEDIUM | None | Authenticity disclaimer, "as-is" terms | Add terms at point of sale |
| Area | Federal/State | Potential Issue | Counsel Type | Status | |------|-------------|----------------|-------------|--------| | Real estate licensing | State-by-state | Referral fees to unlicensed persons, brokerage relationship creation | REAL ESTATE | COUNSEL REVIEW REQUIRED | | TCPA (telephone) | Federal | SMS marketing without prior express written consent | TELECOMMUNICATIONS | COUNSEL REVIEW REQUIRED | | CAN-SPAM Act | Federal | Commercial email without proper opt-out/identification | PRIVACY | COUNSEL REVIEW REQUIRED | | Fair Housing Act | Federal | AI matching/scoring producing discriminatory outcomes | ADVERTISING | COUNSEL REVIEW REQUIRED | | GDPR/CCPA | Federal/State | Privacy practices not matching Privacy Policy | PRIVACY | COUNSEL REVIEW REQUIRED | | State auto-renewal laws | State (CA, NY, etc.) | Auto-renewal without clear disclosure/cancellation | CONSUMER PROTECTION | COUNSEL REVIEW REQUIRED | | Wiretap/two-party consent | State (CA, FL, IL, etc.) | Call recording without all-party consent | TELECOMMUNICATIONS | COUNSEL REVIEW REQUIRED | | INFORM Consumers Act | Federal | Marketplace seller disclosure requirements | CONSUMER PROTECTION | COUNSEL REVIEW REQUIRED | | RESPA | Federal | Referral fee arrangements in real estate transactions | REAL ESTATE | COUNSEL REVIEW REQUIRED | | FTC advertising rules | Federal | Unsubstantiated performance/income claims | ADVERTISING | COUNSEL REVIEW REQUIRED | | COPPA | Federal | Minors data collection (if applicable) | PRIVACY | NOT LIKELY APPLICABLE | | ADA Title III | Federal | Website accessibility barriers | GENERAL COMMERCIAL | COUNSEL REVIEW REQUIRED | | State UDAAP laws | State | Unfair/deceptive practices in billing, guarantees | CONSUMER PROTECTION | COUNSEL REVIEW REQUIRED |
| # | Document | Status | Recommendation | |---|----------|--------|---------------| | 1 | Master Terms of Service | EXISTS (generic, incomplete) | REQUIRED — must be role-aware, address all platform functions | | 2 | Privacy Policy | EXISTS (generic, incomplete) | REQUIRED — must match actual data practices (see §16) | | 3 | Consumer Terms | MISSING | REQUIRED — buyer/seller/consumer protections, no agency relationship | | 4 | Agent Participation Agreement | MISSING | REQUIRED — defines agent's role, responsibilities, platform relationship | | 5 | Lead Acceptance & Referral Agreement | MISSING | REQUIRED — clickwrap before lead access, defines referral obligations | | 6 | Vendor Marketplace Agreement | MISSING | REQUIRED — independent contractor, insurance, indemnification | | 7 | Estate Sale Company Agreement | MISSING | REQUIRED — authority to sell, inventory liability, prohibited items | | 8 | Reseller Terms | MISSING | RECOMMENDED — if marketplace has third-party sellers | | 9 | AI Services & AI Disclosure Policy | MISSING | REQUIRED — AI capabilities, limitations, "not professional advice" | | 10 | Communications Consent (Email/SMS) | MISSING | REQUIRED — TCPA/CAN-SPAM compliance, consent capture | | 11 | Call Recording / AI Transcription Consent | MISSING | REQUIRED — jurisdictional consent, live coaching notice | | 12 | Subscription & Billing Terms | MISSING (partially in ToS) | REQUIRED — auto-renewal, pricing, billing cycle, cancellation | | 13 | Cancellation / Refund Policy | MISSING (partial in ToS) | REQUIRED — clear cancellation procedure, refund eligibility | | 14 | Property Data Disclaimer | MISSING | REQUIRED — ATTOM/MLS accuracy, "not an appraisal" | | 15 | Valuation Disclaimer | MISSING | REQUIRED — AVM limitations, not a licensed appraisal | | 16 | FSBO / Hybrid Services Disclosure | MISSING | REQUIRED — what Houszu provides vs what consumer handles | | 17 | Investor / Cash Offer Disclosure | MISSING | REQUIRED — offer ≠ market value, no guarantee of funding | | 18 | Territory Participation Agreement | MISSING | REQUIRED — exclusivity limits, duration, termination | | 19 | Vendor Revenue Share Agreement | MISSING | REQUIRED — commission calculation, payment terms, attribution | | 20 | Marketing Services Agreement (AIMD) | MISSING | REQUIRED — 2X Guarantee terms, agent responsibilities, attribution | | 21 | Acceptable Use Policy | PARTIAL (in ToS) | REQUIRED — standalone, comprehensive prohibited conduct | | 22 | User Content / IP Policy | PARTIAL (in ToS) | RECOMMENDED — license grant, DMCA, takedown | | 23 | Cookie / Tracking Policy | PARTIAL (in Privacy) | RECOMMENDED — cookie categories, consent mechanism | | 24 | Accessibility Statement | MISSING | RECOMMENDED — commitment, contact method | | 25 | Copyright / Takedown Procedure | MISSING | REQUIRED — DMCA agent, takedown process, repeat infringer | | 26 | Security / Incident Policy | MISSING | REQUIRED — breach response, notification timeline | | 27 | Data Retention Policy | MISSING | REQUIRED — per-entity retention periods, deletion method | | 28 | Internal Legal Hold Policy | MISSING | REQUIRED — hold procedure, scope, admin controls |
| Disclosure | Location | Current Status | Priority | |-----------|----------|----------------|----------| | Terms of Service acceptance | Account registration | MISSING — no checkbox | IMMEDIATE | | Privacy Policy acceptance | Account registration | MISSING — no checkbox | IMMEDIATE | | SMS marketing consent | Lead capture forms / settings | MISSING — no consent language | IMMEDIATE | | Email marketing consent | Lead capture forms / settings | MISSING — no consent language | IMMEDIATE | | Call recording notice | Before call recording starts | MISSING | IMMEDIATE | | AI output disclaimer | Every AI-generated output | MISSING | IMMEDIATE | | Valuation disclaimer | Every property valuation | MISSING | IMMEDIATE | | Property data accuracy | Property detail pages | MISSING | BEFORE LAUNCH | | Vendor independence notice | Vendor profiles, marketplace | MISSING | BEFORE LAUNCH | | Agent independence notice | Agent profiles, matching | MISSING | BEFORE LAUNCH | | Guarantee terms | AI Marketing Department checkout | MISSING — no terms shown | IMMEDIATE | | Auto-renewal notice | Checkout page | PARTIAL — "recurring charges" mentioned | BEFORE LAUNCH | | Cancellation instructions | Settings / billing | PARTIAL — cancel function exists | BEFORE LAUNCH | | FSBO services disclosure | FSBO listing creation | MISSING | BEFORE LAUNCH | | Investor offer disclosure | Cash offer / investor flows | MISSING | BEFORE LAUNCH | | Estate sale authority | Estate sale listing creation | MISSING | BEFORE LAUNCH | | Territory agreement | Territory purchase / assignment | MISSING | BEFORE LAUNCH | | Lead acceptance terms | Before lead access | MISSING | IMMEDIATE | | Revenue calculator disclaimer | Revenue/ROI calculators | MISSING | BEFORE LAUNCH | | Testimonial disclosure | Testimonials sections | MISSING | BEFORE LAUNCH |
| Action | Current Method | Recommended Method | Priority | |--------|---------------|-------------------|----------| | CREATE ACCOUNT | Browsewrap (none) | CLICKWRAP — separate ToS + Privacy checkboxes | IMMEDIATE | | BUY SUBSCRIPTION | None (redirect to Wix checkout) | CLICKWRAP — billing terms + auto-renewal disclosure before redirect | IMMEDIATE | | ACCEPT LEAD | None (auto-assigned) | TRANSACTION-SPECIFIC ACCEPTANCE — clickwrap before viewing lead details | IMMEDIATE | | CLAIM TERRITORY | None | CLICKWRAP — territory agreement before assignment | BEFORE LAUNCH | | JOIN VENDOR MARKETPLACE | None | CLICKWRAP — vendor marketplace agreement | BEFORE LAUNCH | | ACTIVATE ESTATE SALE | None | CLICKWRAP — authority representation + agreement | BEFORE LAUNCH | | ENABLE CALL RECORDING | None | SEPARATE CHECKBOX — jurisdictional consent | IMMEDIATE | | ENABLE MARKETING COMMUNICATIONS | None (assumed from email) | SEPARATE CHECKBOX — email + SMS separately | IMMEDIATE | | UPLOAD CONTENT | None | NOTICE ONLY — IP representation | BEFORE LAUNCH | | FSBO LISTING CREATION | None | CLICKWRAP — FSBO disclosure + accuracy representation | BEFORE LAUNCH | | AI MARKETING DEPT ENROLLMENT | None | CLICKWRAP — guarantee terms + agent responsibilities | IMMEDIATE | | CANCELLATION | Button click | CLICKWRAP — confirm understanding of cancellation terms | BEFORE LAUNCH |
LegalAcceptance (entity)
├── user_id (FK User)
├── master_user_id (for sub-accounts)
├── application (houszu | estatesalen)
├── agreement_type (tos | privacy | lead_acceptance | vendor_agreement | etc.)
├── agreement_version (FK LegalDocumentVersion)
├── agreement_hash (SHA-256 of document text)
├── accepted_at (ISO datetime)
├── ip_address (where legally appropriate)
├── user_agent / device_metadata
├── acceptance_method (clickwrap | checkbox | signature | transaction-specific)
├── related_entity_id (lead_id, subscription_id, territory_id, etc.)
├── checkbox_text_version (the exact text shown to user)
├── session_id
└── metadata (additional context)
├── document_type (tos | privacy | lead_agreement | vendor_agreement | etc.)
├── version_number
├── effective_date
├── text_content (full text or hash reference)
├── text_hash (SHA-256)
├── published_at
├── superseded_at
├── is_active
├── requires_reacceptance (boolean)
└── change_summary
STATUS: NOT IMPLEMENTED — design only. Do not implement until audit is approved.
| Data Type | Source | Purpose | Stored In | Shared With | Retention | Deletion Method | |-----------|--------|---------|-----------|-------------|-----------|----------------| | Name, email, phone | User registration | Account, contact | User entity | Base44 auth, CustomerIO | Active + post-deletion | DSAR delete (partial) | | Password | Registration | Auth | Base44 (hashed) | Base44 only | Active | Account deletion | | Profile photo | User upload | Profile display | File storage | None | Active | User can delete | | Location (city/state/zip) | Onboarding/search | Matching, local content | User entity | None | Active | DSAR delete | | Property info | User input / ATTOM / MLS | Listings, valuations | Property entity | ATTOM (reverse), public (listings) | Active | DSAR delete (user-created) | | CRM contacts | Agent import | Lead management | Contact entity | CustomerIO, AI (LLM) | Active + retention policy | DSAR delete (PII anonymized) | | Lead information | Public forms / imports | Lead management | Lead entity | CustomerIO | Active + retention policy | DSAR delete | | Call recordings/transcripts | Live coach sessions | Coaching, analysis | File storage / Conversation entity | AI (transcription, LLM) | INDEFINITE — no retention policy | No deletion mechanism | | AI conversations | AI chat sessions | Coaching, recommendations | AIConversation entity | AI (LLM) | INDEFINITE | No deletion mechanism | | Uploaded documents | File upload | Property/transaction docs | File storage | AI (if analyzed) | Active | No systematic deletion | | Uploaded photos | User upload | Listings, media | File storage | Public (if listed), AI (if analyzed) | Active | No systematic deletion | | Transaction info | Manual / API | Deal management | Transaction entity | None | Active | DSAR delete | | Payment info | Wix Payments | Billing | Wix (not stored locally) | Wix Payments | Per Wix policy | Per Wix | | Subscription info | Checkout | Billing | UserSubscription entity | None | Active + financial retention | DSAR delete | | IP address | HTTP headers | Security, rate limiting | RateLimit entity | None | Short-term (rate limit window) | Auto-expire | | Device/browser info | HTTP headers | Analytics, security | Analytics platforms | Google Analytics (if enabled) | Per analytics policy | Not implemented | | Cookies | Browser | Auth, preferences | Browser | None | Session/persistent | Browser controls | | Google Calendar data | OAuth | Calendar sync | Google (via API) | None | Per Google | Disconnect OAuth | | Gmail data | OAuth | Email features | Google (via API) | None | Per Google | Disconnect OAuth | | ATTOM property data | API | Valuations, property info | Property/home_value_data | None | Active | No systematic deletion | | MLS data | SimplyRETS API | Listings | SimplyRETSListing entity | Public (listings) | Active | Per MLS agreement | | Commission/wallet | Transaction processing | Revenue sharing | WalletTransaction, CommissionTransaction | None | Active + financial retention | DSAR delete (partial) | | Territory data | Assignment | Territory management | Territory/Assignment entities | None | Active | DSAR delete | | Vendor info | Registration | Marketplace | BusinessPartner entity | Public (marketplace) | Active | DSAR delete | | Estate sale inventory | User input | Marketplace | EstateSale entities | Public (marketplace) | Active | No systematic deletion |
| Claim Location | Claim | Category | Risk | Action Required | |---------------|-------|----------|------|----------------| | AIMD Landing | "Double Your Investment in Commission Within 6 Months — Or Your Next 6 Months Are Free" | GUARANTEE | HIGH-RISK | Requires full guarantee terms, qualification requirements, exclusions, calculation method, remedy, maximum obligation | | Agent Landing meta | "One extra transaction pays for years of membership" | PERFORMANCE CLAIM | NEEDS QUALIFICATION | Add "results vary" disclaimer, define calculation | | Agent Landing | "Become the Agent Buyers and Sellers Cannot Replace" | ASPIRATIONAL | LOW | Acceptable as opinion/puffery | | Agent Hero | "Houszu replaces your ISA, marketing company, transaction coordinator, and listing assistant" | PERFORMANCE CLAIM | NEEDS DOCUMENTATION | Substantiate or qualify — "replaces" implies equivalence | | AIMD Landing | "We Build It. We Run It. You Close It." | SERVICE DESCRIPTION | NEEDS DISCLOSURE | Clarify what "we run" means (AI-generated vs human-reviewed) | | Revenue Calculator | ROI projections | PROJECTION | NEEDS DISCLOSURE | Add "estimates only, not guaranteed" disclaimer | | Various | "AI-powered" / "AI-driven" | CAPABILITY CLAIM | NEEDS DISCLOSURE | Clarify what AI does vs what requires human action | | Agent testimonials | Success stories | TESTIMONIAL | NEEDS DISCLOSURE | Add "results not typical" disclaimer, verify authenticity | | Vendor Revenue Calculator | Vendor income projections | PROJECTION | NEEDS DISCLOSURE | Add "estimates only" disclaimer | | Pricing page | Subscription pricing | FACTUAL | LOW | Ensure prices match actual charges | | SuperAgents | "SuperAgent" designation | CERTIFICATION-LIKE | NEEDS REVIEW | Clarify this is a platform designation, not a professional certification | | AI Workforce | "10+ AI agents" / "AI employees" | CAPABILITY CLAIM | NEEDS DISCLOSURE | Clarify these are AI tools, not human employees |
| AI Feature | Function | Potential Harm | Disclaimer Exists | Human Review Required | Should Require Review | Risk | |-----------|----------|----------------|-------------------|----------------------|----------------------|------| | AI Valuation (ATTOM AVM) | Property value estimation | Reliance on inaccurate valuation | NO | NO | YES | HIGH | | AI Match Engine | Agent-brokerage-team matching | Discriminatory matching, bad fit | NO | NO | NO | MEDIUM | | AI Lead Scoring | Lead prioritization | Discriminatory scoring, lost opportunities | NO | NO | NO | MEDIUM | | AI Marketing Content Generation | Marketing copy, property descriptions | Fair Housing violations, inaccurate claims | Partial (prompt-injection defense in agent configs) | NO (auto-publish available) | YES for high-risk | HIGH | | AI Call Coach / Live Coach | Real-time call analysis, coaching | Recording without consent, advice misinterpretation | NO | NO | YES | HIGH | | AI Repair Estimate | Renovation cost estimation | Inaccurate estimates, reliance damages | NO | NO | YES | MEDIUM | | AI Campaign Builder | Campaign strategy, messaging | Misleading advertising, Fair Housing | Partial (compliance review in workflow) | Configurable | YES for publishing | MEDIUM | | AI Negotiation Room | Negotiation strategy | Legal/financial advice without disclaimer | NO | NO | YES | HIGH | | AI Marketing Director | Autonomous marketing decisions | Unauthorized actions, compliance violations | Partial (approval modes exist) | Configurable | YES for publishing | MEDIUM | | AI Repair Estimator | Repair cost estimates | Inaccurate estimates | NO | NO | YES | MEDIUM | | AI Executive Brief | Business recommendations | Could be construed as financial/business advice | NO | NO | NO | MEDIUM | | AI Security Test Suite | Security testing | False sense of security | Internal only | YES | YES | LOW | | AI Home Value Estimator | Property valuation | Same as AI Valuation | NO | NO | YES | HIGH | | Call Simulator AI | Practice call scoring | Inaccurate competency assessment | NO | NO | NO | LOW |
| Risk Area | Current State | Missing Protection | Severity |
|-----------|-------------|-------------------|----------|
| Lead origin definition | is_houszu_generated flag exists | No legal definition of what constitutes Houszu-originated vs agent-sourced | CRITICAL |
| Existing relationship | No handling | No provision for when agent already knew the consumer | CRITICAL |
| Existing CRM record | No handling | No provision for when lead already exists in agent's database | CRITICAL |
| Duplicate claims | Dedup in leadCapture by email/phone | No duplicate claim resolution between agents | HIGH |
| Attribution duration | No limit | No defined period after which referral obligation expires | CRITICAL |
| Referral obligation trigger | No definition | No definition of what triggers payment (closing? contract? any transaction type?) | CRITICAL |
| Transaction scope | None | Does obligation apply to listings, purchases, investments, rentals, subsequent transactions? | CRITICAL |
| Brokerage change | No handling | No provision for agent changing brokerages | HIGH |
| Team change | No handling | No provision for agent changing teams | HIGH |
| Circumvention | None | No anti-circumvention provision or enforcement | CRITICAL |
| Closing disclosure | None | No requirement for agent to disclose closings | CRITICAL |
| Verification | None | No mechanism for Houszu to verify closings | HIGH |
| Payment deadline | None | No defined deadline for referral payment | HIGH |
| Dispute process | None | No dispute resolution process for referral disagreements | HIGH |
| Acceptance evidence | None | No record of agent accepting referral terms before receiving lead | CRITICAL |
| Risk Area | Current State | Missing Protection | Severity |
|-----------|-------------|-------------------|----------|
| Vendor independence | vendor_visibility field exists | No user-facing notice that vendor is independent from Houszu | CRITICAL |
| Quality guarantee | No representation made | Risk of implied endorsement/guarantee of vendor work | CRITICAL |
| Licensing verification | license_verified field (not enforced) | No requirement to verify license before marketplace listing | HIGH |
| Insurance verification | insurance_verified field (not enforced) | No requirement to verify insurance before listing | HIGH |
| Background checks | Not performed | No representation or disclaimer about background checks | MEDIUM |
| Provider representations | None | No vendor agreement with representations about licensing, insurance, workmanship | CRITICAL |
| Indemnification | None | No vendor indemnification of Houszu | HIGH |
| Property damage liability | None | No allocation of liability for vendor-caused damage | CRITICAL |
| Bodily injury liability | None | No allocation of liability for vendor-caused injury | CRITICAL |
| Subcontractor disclosure | None | No requirement for vendors to disclose subcontractor use | MEDIUM |
| Marketplace facilitator status | None | No disclosure of Houszu's role as marketplace facilitator (INFORM Act) | MEDIUM |
| Dispute resolution | None | No vendor dispute resolution process | MEDIUM |
| Risk Area | Current State | Missing Protection | Severity | |-----------|-------------|-------------------|----------| | Authority to sell | None | No representation "I have legal authority to offer these items for sale" | CRITICAL | | Executor/admin authority | None | No verification or representation of executor/administrator authority | CRITICAL | | Heir disputes | None | No protection against heir disputes over estate items | CRITICAL | | Authenticity/counterfeits | None | No authenticity representation or disclaimer | CRITICAL | | Item pricing/valuation | None | No disclaimer that valuations are estimates | HIGH | | Item descriptions | None | No accuracy representation for item descriptions | HIGH | | Theft/fraud | None | No stolen goods screening or representation | CRITICAL | | Customer injuries | None | No liability allocation for on-site estate sale injuries | HIGH | | Property damage | None | No liability allocation for damage to home during estate sale | HIGH | | Cash handling | None | No cash handling policy or liability allocation | MEDIUM | | Prohibited merchandise | None | No prohibited items list (firearms, controlled substances, recalled goods) | CRITICAL | | Unsold inventory | None | No policy for unsold inventory disposal | MEDIUM | | Donations | None | No policy for donation of unsold items | LOW | | Cleanouts | None | No cleanout service terms or liability allocation | MEDIUM | | Buyouts | None | No buyout terms or valuation methodology | MEDIUM | | Reseller transactions | None | No reseller terms or authority verification | HIGH | | Refunds/chargebacks | None | No estate sale refund/return policy | MEDIUM |
| # | Legal Claim | System Behavior | Contradiction | |---|-----------|----------------|---------------| | 1 | ToS: "You may cancel at any time" | Cancel function exists but no confirmation or acceptance | LEGAL/PRODUCT CONTRADICTION — cancellation exists but no evidence of user understanding terms | | 2 | Privacy: "You may request deletion of your data at any time" | DSAR function exists but is not integrated into all flows, call recordings/AI conversations have no deletion | LEGAL/PRODUCT CONTRADICTION — deletion promised but not fully implemented | | 3 | ToS: "By creating an account... you agree to these Terms" | No acceptance mechanism at registration | LEGAL/PRODUCT CONTRADICTION — no clickwrap or checkbox | | 4 | ToS: "FSBO sellers acknowledge they are representing themselves" | No acknowledgment mechanism in FSBO flow | LEGAL/PRODUCT CONTRADICTION — no acceptance step | | 5 | Privacy: "We apply PII redaction before sending data to external AI services where feasible" | No evidence of PII redaction in LLM calls | LEGAL/PRODUCT CONTRADICTION — claim not verifiable | | 6 | ToS: "Refunds are handled on a case-by-case basis" | No refund request mechanism or policy | LEGAL/PRODUCT CONTRADICTION — no process defined | | 7 | ToS: "Material changes will be notified via email" | No versioning system, no re-acceptance mechanism | LEGAL/PRODUCT CONTRADICTION — cannot verify notification or acceptance | | 8 | Privacy: "Specific retention periods are defined in our Data Retention Policies" | DataRetentionPolicy entity exists but retention engine only covers limited entities; call recordings and AI conversations have no retention policy | LEGAL/PRODUCT CONTRADICTION — policy references not implemented | | 9 | ToS: "You agree to indemnify and hold Houszu harmless" | No indemnification acceptance, no evidence of agreement | LEGAL/PRODUCT CONTRADICTION — browsewrap only | | 10 | ToS: "These Terms are governed by the laws of the State of Texas" | No governing law acceptance, no venue consent | LEGAL/PRODUCT CONTRADICTION — no affirmative acceptance | | 11 | Privacy: "We will respond within 30 days" | No SLA tracking or response mechanism for privacy requests | LEGAL/PRODUCT CONTRADICTION — no process | | 12 | ToS: "AI-generated insights... should not be relied upon as legal, financial, or professional advice" | Disclaimers exist in Terms but NOT at point of AI output | LEGAL/PRODUCT CONTRADICTION — disclaimer buried, not conspicuous |
| Issue | Counsel Type | Question | |-------|-------------|----------| | Referral fee structure legality | REAL ESTATE | Does paying referral fees through this structure violate any state real estate licensing laws? | | Lead acceptance agreement enforceability | TECHNOLOGY / SaaS | What acceptance method is required for a binding lead referral agreement? | | TCPA/SMS consent requirements | TELECOMMUNICATIONS | What level of consent is required for automated SMS marketing via CustomerIO? | | 2X Guarantee terms | CONSUMER PROTECTION | What terms, exclusions, and disclosures are required for an enforceable results guarantee? | | Call recording consent | TELECOMMUNICATIONS | What consent is required for AI live coaching/call recording in all 50 states? | | Auto-renewal compliance | CONSUMER PROTECTION | What disclosures are required for auto-renewing subscriptions in all states? | | Browsewrap enforceability | GENERAL COMMERCIAL | Will current browsewrap Terms survive challenge? What clickwrap is needed? |
| Issue | Counsel Type | Question | |-------|-------------|----------| | Vendor marketplace liability | GENERAL COMMERCIAL | What liability does Houszu have for vendor actions on the marketplace? | | INFORM Act applicability | CONSUMER PROTECTION | Does the vendor marketplace trigger INFORM Consumers Act disclosure requirements? | | Fair Housing AI compliance | ADVERTISING | Do AI matching/scoring algorithms risk Fair Housing violations? What testing is needed? | | Estate sale authority | REAL ESTATE | What representations are needed for estate sale companies to verify authority to sell? | | FSBO/hybrid services | REAL ESTATE | What disclosures are needed to distinguish Houszu's services from brokerage services? | | Investor/cash offer disclosures | CONSUMER PROTECTION | What disclosures distinguish investor offers from market value estimates? | | Privacy policy update | PRIVACY | What must the Privacy Policy disclose to match actual practices? | | Data retention requirements | PRIVACY | What are the legal retention requirements for financial, communication, and consent records? |
| Issue | Counsel Type | Question | |-------|-------------|----------| | IP protection strategy | INTELLECTUAL PROPERTY | What terms are needed to protect AI prompts, workflows, and proprietary algorithms? | | Indemnification provisions | GENERAL COMMERCIAL | Which agreements need indemnification and what scope? | | Limitation of liability enforceability | GENERAL COMMERCIAL | Are current liability caps enforceable in all jurisdictions? | | Dispute resolution strategy | GENERAL COMMERCIAL | Should arbitration, class-action waiver, and venue clauses be included? | | Accessibility compliance | GENERAL COMMERCIAL | What WCAG compliance level is required? What is the exposure? | | Acceptable use policy | GENERAL COMMERCIAL | What prohibited conduct should be addressed? | | Data processing agreements | PRIVACY | What DPAs are needed with Base44, OpenAI, CustomerIO, ATTOM, Google? |
After this audit is approved, draft and implement legal documents in this order:
| Category | Score | Justification | |----------|-------|---------------| | Contract Formation | 15/100 | Browsewrap only at registration; no clickwrap for any legally meaningful action; no transaction-specific acceptance | | Evidence of Acceptance | 5/100 | No legal acceptance ledger; no versioning; no evidence of what users agreed to or when | | Real Estate Exposure | 20/100 | No lead acceptance agreement; no referral agreement; no state-specific compliance; referral compensation to potentially unlicensed persons | | Marketplace Liability | 15/100 | No vendor agreement; no independence notice; no insurance/license verification; no indemnification | | Privacy | 35/100 | Privacy Policy exists but doesn't match practices; DSAR partially implemented; no retention policy for AI data; no cookie consent | | Communications Consent | 10/100 | No SMS/email consent capture; no call recording consent; opt-in assumed from email provision | | AI Liability | 20/100 | No point-of-output disclaimers; no human review gates for high-risk outputs; generic disclaimer buried in Terms | | Advertising Claims | 25/100 | 2X Guarantee without terms; revenue calculators without disclaimers; testimonials without disclosure | | Billing | 40/100 | Cancel function exists; auto-renewal mentioned but not conspicuous; no refund process; no billing terms clickwrap | | Lead/Referral Agreements | 5/100 | No agreement whatsoever; no attribution definition; no circumvention protection; no verification rights | | Third-Party Providers | 30/100 | Third-party disclaimer in ToS; no DPA; no outage/accuracy risk disclosure | | Data Governance | 35/100 | RLS implemented (security audit); DSAR partial; retention policy partial; no legal hold; no consent ledger | | Dispute Preparedness | 10/100 | No evidence preservation; no complaint management; no legal hold; no dispute process | | Legal Evidence | 5/100 | No acceptance ledger; no versioning; no consent records; cannot prove what user saw or agreed to | | OVERALL | 31/100 | Significant legal exposure across all categories. Immediate remediation required before broader launch. |
| Category | Score | Justification | |----------|-------|---------------| | Contract Formation | 5/100 | No dedicated terms; relies on Houszu's generic ToS which doesn't address estate sales | | Evidence of Acceptance | 5/100 | Same as Houszu — no acceptance ledger | | Real Estate Exposure | 10/100 | No authority-to-sell representation; no executor/heir verification; no prohibited items policy | | Marketplace Liability | 5/100 | No estate sale agreement; no reseller terms; no authenticity disclaimers; no liability allocation | | Privacy | 25/100 | Shares Houszu Privacy Policy; no estate-sale-specific data disclosure | | Communications Consent | 10/100 | Same as Houszu | | AI Liability | 15/100 | AI item valuations with no disclaimers; no human review | | Advertising Claims | 20/100 | No specific claims audited; no valuation disclaimers | | Billing | 20/100 | No estate-sale-specific billing terms | | Lead/Referral Agreements | 5/100 | No agreement | | Third-Party Providers | 15/100 | No DPA; no disclosure | | Data Governance | 20/100 | No estate-sale-specific data governance | | Dispute Preparedness | 5/100 | No evidence; no complaint process; no authority verification | | Legal Evidence | 5/100 | Same as Houszu | | OVERALL | 14/100 | No legal framework for estate sale operations. Critical exposure. |
The following terms appear in front-end code and marketing copy and require review for unintended legal promises:
| Term | Locations Found | Risk Assessment |
|------|-----------------|----------------|
| GUARANTEE / GUARANTEED | AIMD landing ("2X Guarantee"), various marketing | HIGH-RISK — guarantee terms not defined at point of presentation |
| CERTIFIED | Not prominent | LOW — verify usage doesn't imply professional certification |
| VERIFIED | Vendor license_verified / insurance_verified fields | MEDIUM — fields exist but verification not enforced; "verified" implies completed check |
| APPROVED | Various approval workflows | LOW — internal workflow term, verify no user-facing "approved" claims |
| SAFE / SECURE | Security audit, security command center | LOW — internal; verify no user-facing "secure" promises beyond generic |
| BEST | Marketing copy | LOW — puffery, generally acceptable |
| ACCURATE | Valuation tools, property data | HIGH-RISK — implies accuracy guarantee; needs "estimate" qualifier |
| EXCLUSIVE | Territory assignments | HIGH-RISK — may create unintended property/contractual rights |
| OWNER | Territory "owner", territory partner | MEDIUM — verify doesn't imply legal ownership |
| PARTNER | Territory Partner, Strategic Partner | MEDIUM — verify doesn't imply legal partnership entity |
| FREE | "Free" period in guarantee | MEDIUM — verify terms are clear |
| FAIR MARKET VALUE | If used in valuation context | HIGH-RISK — verify not used for AI estimates |
| APPRAISAL | If used anywhere | HIGH-RISK — must never appear without "not an appraisal" disclaimer |
| EXPERT | AI coaching, AI experts | MEDIUM — verify doesn't imply licensed professional |
| LICENSED | Agent terms, vendor fields | MEDIUM — verify usage is accurate, not implying Houszu verifies licenses |
| INSURED | Vendor fields | MEDIUM — verify Houszu doesn't imply vendor insurance is verified unless actually verified |
| PROTECTED | Security context | LOW — internal usage |
| Document | Location | Status | Issues |
|----------|----------|--------|--------|
| Terms of Service | /terms (TermsOfService.jsx) | INCOMPLETE | Generic; doesn't address lead acceptance, referral fees, vendor marketplace, estate sales, AI-specific terms, auto-renewal details, cancellation process; browsewrap only; no versioning |
| Privacy Policy | /privacy (PrivacyPolicy.jsx) | INCOMPLETE | Doesn't mention call recording, AI transcription, Gmail/Calendar access, ATTOM/SimplyRETS data sources, cross-platform data sharing; no cookie consent mechanism; DSAR process vague |
| Agent Terms | MISSING | MISSING | No agent participation agreement exists |
| Vendor Terms | MISSING | MISSING | No vendor marketplace agreement exists |
| Estate Sale Terms | MISSING | MISSING | No estate sale company agreement exists |
| Subscription Terms | PARTIAL (in ToS §6) | INCOMPLETE | Doesn't address auto-renewal disclosure requirements, refund process, price change notification |
| Refund Policy | PARTIAL (in ToS §6) | INCOMPLETE | "Case-by-case basis" with no process or criteria |
| Lead Agreement | MISSING | MISSING | No lead acceptance or referral agreement |
| Referral Agreement | MISSING | MISSING | No referral fee agreement |
| Cancellation Policy | PARTIAL (in ToS §6) | INCOMPLETE | No standalone policy, no confirmation mechanism |
| AI Disclosure | MISSING | MISSING | No AI-specific terms or disclosures |
| Communications Consent | MISSING | MISSING | No email/SMS consent capture or terms |
| Call Recording Consent | MISSING | MISSING | No consent mechanism |
| FSBO Disclosure | MISSING | MISSING | No FSBO/hybrid services disclosure |
| Acceptable Use Policy | PARTIAL (in ToS §3) | INCOMPLETE | Basic list, no enforcement mechanism |
| DMCA/Takedown | MISSING | MISSING | No copyright takedown procedure |
| Data Retention Policy | PARTIAL | INCOMPLETE | Entity exists but not enforced for all data types |
Plaintiff Argument: "Houszu presented this vendor as a 'verified' or 'preferred' provider. I relied on Houszu's recommendation. The vendor damaged my property."
Current Defense: Terms of Service §9 (third-party services) — "We are not responsible for the practices or content of these services."
Missing Defense: No vendor marketplace agreement establishing independence; no point-of-presentation disclaimer; no insurance verification; license_verified / insurance_verified fields exist but are not enforced.
Evidence Gap: Cannot prove user saw independence disclaimer (no acceptance ledger).
Plaintiff Argument: "Houszu represented this as a qualified lead. It was fake/spam. My client wasted time and money." Current Defense: None — no lead quality representation or disclaimer. Missing Defense: Lead quality disclaimer; lead acceptance agreement with "as-is" provision.
Plaintiff Argument: "The AI assistant told me this contract clause was fine. It wasn't. I was sued." Current Defense: ToS §10 — "AI-generated insights... should not be relied upon as legal, financial, or professional advice." Missing Defense: Point-of-output disclaimer; no "REVIEW REQUIRED" gate; no human review for consequential AI actions. Evidence Gap: Disclaimer buried in Terms, not at AI output point.
Plaintiff Argument: "Your AI valuation said $500K. I listed at $500K. It sat for 6 months. I sold for $440K. I lost $60K." Current Defense: ToS §10 — "AI-generated... valuations... are for informational purposes only." Missing Defense: Point-of-output disclaimer "not a licensed appraisal"; accuracy disclaimer. Evidence Gap: No disclaimer at valuation display point.
Plaintiff Argument: "Houszu paid referral fees to [party] who is not a licensed real estate professional. This violates state law." Current Defense: None. Missing Defense: Licensing verification before compensation; referral agreement with licensing representation. Evidence Gap: No licensing verification in compensation flow.
Plaintiff Argument: "I never consented to SMS marketing. I received automated texts. This violates the TCPA." Current Defense: None — opt-in assumed from email provision. Missing Defense: Affirmative SMS consent capture; consent ledger; suppression evidence. Evidence Gap: No consent record; no evidence of what user agreed to.
Plaintiff Argument: "Houszu recorded/transcribed my call without my consent. I live in a two-party consent state." Current Defense: None. Missing Defense: Call recording consent; jurisdictional notice; consent ledger. Evidence Gap: No consent mechanism; no recording notice.
Plaintiff Argument: "I cancelled my subscription but was charged for 3 more months." Current Defense: Cancel function exists. Missing Defense: Cancellation confirmation clickwrap; billing cessation verification. Evidence Gap: No cancellation acceptance record.
For each critical transaction, can we prove:
| Transaction | What User Saw | What User Agreed To | What Version | When | System Behavior | Communication Sent | Consent Existed | Who Performed Action | Provider Responsible | Data Source | |-------------|--------------|--------------------|--------------|-------|----------------|--------------------|----------------|---------------------|---------------------|-------------| | Account Registration | Form only | Browsewrap ToS | NO VERSIONING | Timestamp only | Account created | None | NO CONSENT RECORD | User | N/A | N/A | | Subscription Purchase | Wix checkout | ToS link only | NO VERSIONING | Timestamp | Checkout created | None | NO CONSENT RECORD | User + Wix | Wix | N/A | | Lead Acceptance | Lead viewable | NONE | NONE | NONE | Auto-assigned | None | NONE | System | N/A | N/A | | Vendor Registration | Form only | NONE | NONE | Timestamp | Profile created | None | NONE | User | N/A | N/A | | FSBO Listing | Form only | NONE | NONE | Timestamp | Listing created | None | NONE | User | N/A | N/A | | AI Valuation | Value displayed | NONE | NONE | Timestamp | AI generated | None | NONE | System | AI | ATTOM | | Call Recording | Call recorded | NONE | NONE | Timestamp | Recorded | None | NONE | System | N/A | N/A | | Cancellation | Button click | NONE | NONE | Timestamp | Subscription cancelled | None | NONE | User | N/A | N/A |
Result: EVIDENTIARY GAP across all critical transactions. The system cannot currently prove what users saw, agreed to, or consented to for any legally meaningful action.
The following legal/compliance controls depend on Base44 platform capabilities. Do not assume Base44 supports:
| Control Needed | Base44 Capability | Classification | |---------------|-------------------|---------------| | Immutable audit records | AuditLog entity exists but is not immutable (can be updated/deleted by service role) | APPLICATION CONTROL (limited) | | Legal holds | No platform-level hold mechanism; must be implemented at application layer | APPLICATION CONTROL | | Encryption at rest | Platform-managed (unknown status) | BASE44 CONTROL — confirm with support | | Log retention | No configurable retention for system logs | BASE44 CONTROL | | Geographic storage controls | Unknown | BASE44 CONTROL — confirm with support | | Cookie consent management | No platform-level cookie consent | APPLICATION CONTROL | | MFA enforcement | Platform-managed (per-role not available) | BASE44 CONTROL — pending support | | IP-based brute-force protection | Unknown for login | BASE44 CONTROL | | Data processing agreement | Not established | COUNSEL / OPERATIONAL CONTROL | | Backup/RPO/RTO | Platform-managed (unknown) | BASE44 CONTROL — confirm with support |
This audit was conducted skeptically and does not assume:
No production behavior was changed during this audit. The dataSubjectRequest and dependencyScanner functions created in the same session are security audit completions, not legal audit remediations.
PHASE 2 (Legal Document + Compliance Engine Buildout) should only begin after this audit is reviewed and approved by legal counsel.
End of Master Legal Exposure Audit — 2026-07-26