Research guide

Best DST 1031 Exchange Companies (2026): Questions About Data Privacy and Document Retention

By Sequoia ResearchPublished Read as Markdown

What Is This Article About?

This article explains how to read a DST provider's privacy policy before sharing files. DST stands for Delaware statutory trust. We compare two public policies and ask who gets your records, who can use them, and how long they stay. You will learn which questions to ask about stored files, account access, and the choice to stop marketing contact.

Table of Contents

Start With the Document and the Receiving Company

Privacy becomes easier to discuss when you start with a specific document. “How do you protect my data?” is reasonable, but it can produce a broad answer. “Which company will receive this tax form, and who will be able to open it?” gives the provider something concrete to explain.

More than one business may take part in a DST process. A website may introduce an investment. A separate broker-dealer may handle the securities work. Other firms may need records for their own tasks. Names that appear in the same conversation do not all fall under one privacy policy.

First, identify the party making the request. Record the full business name, the person's role, the document requested, and the reason given. Then identify the destination where the document would be uploaded or delivered. Those details should fit together before you send sensitive information.

For example, an investment platform's public privacy page may explain website use. A broker's customer notice may address a financial relationship. An outside document service may have its own terms. Ask which notice applies to the particular record and which company is responsible for answering questions about it.

This is a request for clarity, not an instruction to avoid every outside service. Providers can use other companies to perform legitimate tasks. The useful question is what those companies receive, what they are allowed to do, and how the relationship is explained to you.

We read two public privacy policies on October 16, 2026. We also checked official guidance. We did not open accounts, upload records, inspect systems, test controls, or check staff access. Our findings describe what the pages say. They do not show how the firms perform those tasks.

That distinction matters in a search for the best DST 1031 exchange companies. A detailed privacy page can help you prepare questions. It cannot establish that a firm has never had a breach, that every employee follows the policy, or that its investments suit you. Those would require different evidence.

What Two Public Privacy Policies Disclose

The sample below is limited to the named public pages. Dates describe what the pages display; they do not prove when every underlying practice was last tested.

Policy inspected Visible date Selected disclosure Question left for the provider
Realized website privacy policy Last edited August 3, 2026 Discusses call recordings and transcripts, service-provider use, and retention based on stated purposes and legal recordkeeping needs. Removal may be incomplete because of reporting duties, investment records, backups, or deletion records. Which retention rule and access limits apply to the specific document or recording?
1031 Crowdfunding privacy policy February 7, 2022 Describes employee access based on service needs and sharing with outside companies under confidentiality and use limits. The inspected policy body gives no document-by-document retention schedule. Where is the applicable retention explanation, and which legal entity holds each account record?

The Realized policy distinguishes several uses and choices, including communications and information removal. Those passages need to be read together. Stopping contact is not the same request as removing stored records. We did not test either process or infer a deletion date for any customer. Realized privacy policy.

The 1031 Crowdfunding footer names Capulent as the separate broker-dealer for securities services. Ask which firm's policy covers the task. The older page date does not prove that the firm's practices are out of date. Request the notice that applies to the service you plan to use. 1031 Crowdfunding privacy policy.

Neither row is a security grade. A missing public detail may be explained in an account notice, agreement, or direct response. Conversely, a detailed public statement is still a statement until there is evidence of how it is carried out. Keep your comparison at the level the evidence supports.

Save the exact page and the date you read it. If a provider sends a different notice, keep both and ask which one governs the record in question. Do not silently replace one with the other and lose the reason you asked.

Separate Collection, Use, Sharing, and Retention

Four questions organize most of the review. What is collected? What is it used for? Who receives it? How long is it kept? An answer to one does not settle the others.

Collection concerns the information requested or gathered. A form might ask for contact details, identity information, financial facts, or supporting documents. Ask which fields are required for the specific task and which are optional. A required field should have an explanation tied to the actual process.

Use concerns what happens to the information after collection. A record might support account administration, identity review, a service request, or a communication preference. Ask whether the same record is used for more than one purpose and where those uses are described.

Sharing concerns recipients outside the initial receiving team or company. A service provider may process a record on the firm's behalf. A separate financial firm may receive it for its own role. Those situations can involve different notices and responsibilities. Ask for the distinction in plain language.

Retention concerns how long a record remains and what ends that period. The answer may depend on the record type, the business relationship, legal requirements, or a dispute. “We keep it securely” says little about duration. “We delete accounts on request” may say little about records that must remain.

Use a small table for one document at a time:

Question Specific detail to request
What is collected? The needed fields or document version
Why is it needed? The task that requires it
Who first receives it? The legal entity and responsible team
Who else receives it? Recipient categories and their purposes
Who can access it? Roles, permissions, and any limits
How long does it remain? Retention rule and starting event
How is it corrected or removed? Request route, limits, and confirmation

This is an original question framework. It is not a list of universal legal requirements for every provider. Its value is that it prevents a general promise from standing in for a missing answer.

For example, a response might clearly explain the upload route but say nothing about copies sent to another company. Record the route as answered and the sharing question as open. Do not give the whole document a single “approved” status that hides the gap.

Ask Who Can Open Each Investor Record

Access should be discussed by role and purpose. The fact that a company has a record does not tell you which people can view, change, download, or forward it.

Ask whether the person working with you needs the full document or only a result from another team. A representative may need to know that a review is complete without needing every supporting page. The provider should explain the process that applies; do not assume it offers a reduced-data option until it confirms one.

Separate viewing from editing. Someone who can read a record may not be able to change it. Someone who can upload a replacement may not have authority to approve it. If you are correcting an error, ask which action is available and who reviews the change.

Ask about access within the firm and by outside parties. A phrase such as “authorized personnel” may cover several roles. A useful reply names those roles and explains why each needs access. It need not reveal private staff details or the firm's system design.

You can ask about controls without demanding an internal security blueprint. For example: how is access removed when a staff member changes roles? Is a separate login used for each authorized person? How are unusual access events reviewed? The provider may answer at a policy level or offer an appropriate assurance document.

If you want a spouse, trustee, accountant, or other adviser to help, ask about the proper permission process. Do not assume that sharing your own login is the intended route. Clarify what the helper can see and whether the permission can be limited or ended.

Think about duration too. A person may need access while a transaction is being reviewed but not after a particular task ends. Ask how temporary access is handled and how you can confirm a requested change. The answer may differ for a household helper and for a firm's employee.

Keep your notes factual. “The provider says access is limited to specified roles” records a disclosed policy. “Only those people have ever opened the record” would be a much stronger claim. A public policy and a conversation do not establish that history.

Review the Upload Route Before Sending Documents

A request for a sensitive file deserves a clear destination. Confirm that the route belongs to the expected business and is intended for the type of document being requested. A familiar name in an email is not enough by itself.

The Securities and Exchange Commission, or SEC, issued online-account guidance on April 23, 2026. It urges care with private financial data and unexpected links. It also discusses added login safeguards and reading a cloud service's security policies before storing records there. Check the route before you upload. SEC online-account guidance.

Ask the provider how the upload is acknowledged. Does the portal show a receipt? Does a team confirm that the file is readable? Does an uploaded status mean only that the file arrived, or that someone reviewed it? These are different events.

For a fictional example, imagine that you upload a statement and see “received.” That tells you the system accepted a file. It does not necessarily mean the right period was supplied, the pages were complete, or the required review is finished. Ask what the status means before relying on it.

If the request changes from a portal to an email attachment, verify the change through a route you already trust. Ask why the different method is needed and what protection is provided. Do not infer that urgency makes an unfamiliar route appropriate.

Ask whether the firm accepts another form of proof that shares less data. It may need a certain statement or set of fields. It may need the full original file. Get the answer before you hide details or replace a page. A changed file may not meet the firm's needs.

Keep a simple record of what you actually sent: document type, version, recipient entity, route, and date. Avoid copying sensitive contents into a broad project note just to track the transfer. The record should help you find the file and receipt without creating unnecessary extra copies.

Finally, distinguish a secure connection from a complete privacy review. A website address and login screen do not answer who retains the document, which other parties receive it, or whether access changes after the task ends. The upload check is one part of the larger question.

Distinguish Marketing Choices From Account Records

A privacy policy may discuss newsletters, calls, website tracking, financial records, and required notices on the same page. Those uses can have different choices and limits. Read the category that applies to your request.

An unsubscribe request concerns communications. A request to correct an address concerns the accuracy of stored information. A request to close online access concerns how you reach the system. A deletion request concerns whether information remains. None should be assumed to perform all the other actions.

Suppose an investor in a made-up example asks to stop sales emails. The firm confirms that they have stopped. That reply does not show that a stored identity file was deleted. If both results matter, ask for both and keep each answer.

The reverse can also be true. A provider may need to send a required notice even when the person has opted out of marketing. Ask which communications are optional and which are tied to an account or legal obligation. The answer should identify the relevant category rather than simply saying that all contact has stopped.

Do not assume a website cookie choice controls the treatment of a document uploaded through an account. Browser tracking and account records are different subjects. Ask how the stated choice affects the particular information you are concerned about.

Name the action you want. Ask to stop sales calls, fix a field, end a helper's access, or explain why a file is kept. A clear request is easier to answer. It is also easier to check later.

Keep dates for requests and responses, but do not invent a legal response deadline. Time limits and rights can depend on the applicable law, entity, record, and circumstances. If a response cites an exception or a legal duty, ask for enough explanation to understand its scope and seek qualified advice if needed.

The aim is not to make every privacy choice into a dispute. It is to avoid a common misunderstanding: receiving an answer to one request and treating it as completion of several different requests.

Ask for a Retention Explanation by Record Type

A useful retention answer names both the record and the rule for keeping it. It should explain the event from which the period runs, any relevant exceptions, and what happens when the period ends.

Ask about each record type. Opening forms, trade records, supporting files, letters, call recordings, and website logs may have different schedules. One number may not cover them all. Ask which records it describes.

The Financial Industry Regulatory Authority, or FINRA, sets record rules for member firms. Its Rule 4511 requires those firms to make and preserve required books and records. It sets a period of at least six years for FINRA records where no period is specified under FINRA or applicable Exchange Act rules. That is not a universal six-year rule for every file held by every DST-related company. Ask which requirement applies to the specific record. FINRA Rule 4511.

The starting event matters as much as the duration. A period might run from creation, a transaction, the end of a relationship, or another event under the applicable rule. Do not choose one yourself. Ask the provider to explain the relevant start and any event that can extend retention.

A fictional comparison shows the problem. One response says a category remains for a stated period after the record is created. Another says a category remains for a stated period after the account closes. Even if both use the same number of years, they do not describe the same end date.

Ask about the original file and each later version. Also ask about the record that a review took place. A firm may keep proof of that step while handling the source file in a different way. The policy and rules decide the answer.

A request for deletion may therefore produce a partial response. Some information may be removable while other records remain for a stated reason. Ask which categories were affected, which were retained, and how retained information can be used. “Request completed” is too broad if it hides those differences.

Keeping a record longer is not always worse. Keeping it for less time is not always better. Required records can protect the firm and the investor. Extra copies can raise other concerns. Look for a clear reason that applies to the file and a defined process for handling it.

Check What Happens to Copies and Backups

A document can exist in more than one place. The original upload, a reviewed copy, a message attachment, and a backup may follow different processes. Ask which locations the provider's answer covers.

You do not need a map of every server. You do need to know whether a deletion or access change applies only to the visible portal or also to the relevant working copies. A file disappearing from your account view does not, by itself, prove that every retained copy is gone.

Ask how the provider distinguishes active use from retained storage. A record kept for a legal purpose may be handled differently from a document used in current service. The response should explain what access and uses remain, at a level appropriate for a customer.

Ask about backups too. Can a deleted file stay in a backup? How is that copy protected? What happens when the backup expires or is used to restore files? Do not assume every copy is gone unless the firm's answer supports that result.

Outside service providers can create another layer. If a document was shared for a task, ask whether the original firm's response covers that recipient too. If it does not, ask which party can explain the remaining copy and any separate request process.

Consider a fictional file with three known locations: the upload portal, the review team's record system, and an outside service used for one task. A response about the portal answers one part of the question. It does not establish what happened in the other two locations. The point is completeness, not a claim that three locations are unsafe.

Keep private details out of your tracking notes. You can record that an identity file was uploaded without copying its ID number. Keep the actual file and private receipts in a suitable place. A general comparison sheet does not need to contain them.

The firm may not share its internal system details. Ask instead for a plain account of the result. Which types of records remain? Why? Who handles a request to fix or remove them? Those answers may resolve your question without exposing private system details.

Understand the Scope of Current Privacy Rules

Privacy duties depend in part on the firm and the data it holds. A business that markets DST services may not be subject to every securities-firm rule. Name the firm and its role first. Then ask which rules apply.

The SEC guide to its 2024 Regulation S-P changes covers several types of firms. They include broker-dealers and SEC-registered investment advisers. It discusses how to protect and dispose of data, respond to incidents, oversee vendors, and keep required records. The guide lists compliance dates of December 3, 2025 for larger firms and June 3, 2026 for smaller firms. We did not test whether either sampled provider met its duties. SEC small-entity compliance guide.

The SEC also held a January 22, 2026 outreach event for small firms ahead of the June 3 date. That provides current context for asking which policy applies to a covered relationship. It does not make a public privacy page a compliance audit. SEC 2026 outreach event.

Ask which notice applies and which firm is responsible. A different company may handle the account. If so, ask for that firm's notice too. The platform's website policy may cover only part of the work.

A public policy may also refer to state law or other rules. The existence of that reference does not tell you whether a particular right applies to every record in your file. Ask for an explanation tied to the request rather than a broad claim that all data can or cannot be removed.

This article does not determine whether a company has met its legal duties. It gives you a way to ask for the relevant policy, preserve the response, and identify questions that need qualified legal advice. A missing detail in a public page is not itself proof of a violation.

For incident notices, ask how the firm would contact you and how you should report a concern. Keep your contact information current through the firm's proper process. Do not calculate a legal notification deadline from this article or assume that every technical event triggers the same notice duty.

The practical goal is a usable route for questions. You should know which company holds the record, who receives a privacy request, and how to recognize a genuine response. The regulatory context helps frame that discussion; it does not replace the facts of your relationship.

Plan for Corrections, Departures, and Closed Accounts

Privacy questions do not end when the document arrives. A record may need correction, a staff member may leave, or your relationship with the provider may end. Ask how each event changes access and record handling.

For a correction, identify the specific field or document version at issue. Ask whether the new information replaces an active value, creates a new version, or leaves an earlier record preserved with a correction note. Those outcomes can all matter when someone later reviews the file.

A changed address illustrates the distinction. Updating the current address may not rewrite every historical document. Ask which current communications and records will use the new value and how the earlier record is marked. Do not assume that an old document remaining in the file means the current correction failed.

When a representative changes firms or roles, ask which company keeps the records and who becomes your contact. A familiar person's departure does not automatically tell you whether your documents moved. If a new recipient requests the same files, verify the new role, purpose, and route before resending them.

If you granted a helper access, review that permission when the task ends. Ask how to remove or narrow it and what confirmation you will receive. Removing access is different from deleting records the helper was already allowed to download; ask about that distinction before granting access in the first place.

Closing an account or declining an investment can also leave records behind. Ask what portal access ends, which documents you should retain, and which records the firm keeps. Do not wait until you can no longer log in to learn how to obtain a needed record through an authorized route.

Preserve the answers in plain terms. “Portal access ended; transaction records remain under the stated retention policy” is more informative than “account deleted.” Use the wording that fits the actual response instead of choosing a convenient but broader label.

If two answers conflict, keep both and ask why. A new notice may replace an old one. Or the notices may cover different firms or files. Resolve that point before choosing the sentence you prefer. It may not apply to every record.

Work Through a Fictional Document Request

Dana is an investor in this made-up example. Dana has not yet chosen a firm. An invented provider, Cedar, asks for a contact form, a financial statement, and an identity file. Cedar is not a real company. The example does not describe any actual firm's required documents.

Dana first records the purpose of each request. The contact form supports an initial conversation. The statement is requested for a stated financial review. The identity document is requested for a separate account process. Dana asks whether each item is needed now or only if the relationship moves to the next stage.

The response says that the contact form goes to the platform, while the two documents go through a separate firm's portal. Dana asks for the receiving entity's name and applicable notice. This prevents the platform's general website policy from becoming an assumed answer for the separate account process.

Next, Dana asks whether the full statement is required. The fictional firm says it needs the stated document in full for this process. Dana does not treat this article as authority to redact it. Instead, Dana decides whether to continue after understanding the request and verifying the destination.

Dana then asks about access and retention. The firm explains the relevant team roles but gives only a broad answer about how long the documents remain. Dana marks access as explained at the policy level and retention as still open. No overall privacy score is assigned.

Before uploading, Dana receives an email pointing to a different destination. Dana verifies the change through the firm's previously confirmed contact route. The example does not assume the email is fraudulent; it shows why a changed route needs confirmation before sensitive data is sent.

Later, Dana decides not to proceed and asks to stop promotional contact. The firm confirms that choice. Dana separately asks what happens to the submitted records. The firm says some records must remain and identifies the category and basis. Dana asks which other copies the response covers and how future questions should be directed.

The final record separates the outcomes:

Item Fictional outcome recorded What remains distinct
Promotional contact Stop request acknowledged Whether stored records remain
Portal access Closure process explained Retention of required records
Document retention Category and basis supplied Scope of copies and backup handling
Future questions Responsible contact identified Whether a later request is granted

Nothing in this example proves Cedar has good security or that Dana should choose its investments. The useful result is a series of specific answers and visible gaps. Each request has a purpose, a recipient, and a record of what was actually confirmed.

You can use the same method without making a long dossier. Start with the few documents that contain the most sensitive information. Resolve who needs them, why, where they go, and which policy applies. Add detail only when it changes the decision about sharing or retaining the record.

Compare Answers Without Inventing a Security Score

Compare the completeness and clarity of the answers you received. Do not treat them as measurements of a firm's technical security unless you have evidence that supports that stronger conclusion.

One firm may clearly name the company that receives a file and the rule for keeping it. Another may not yet have answered. Record that difference in the replies. It does not prove that the first firm has better systems or that the second has misused data.

Keep “not disclosed,” “not asked,” and “not confirmed” separate. They describe different gaps. A missing answer may simply reflect a question that has not reached the right team. Give the provider a clear request and record the response before drawing a broader conclusion.

Use short evidence labels in your notes. Public policy means you read a posted statement. Written response means someone answered your specific question. Observed account control means you saw a feature available in your account. None of those labels should silently become independent verification of the entire process.

A small number of unresolved questions can matter more than a large number of easy answers. If you still do not know which company receives an identity document, ten clear answers about newsletters will not settle that issue. Keep the comparison tied to the documents you are actually considering sharing.

The same principle helps avoid false reassurance from polished language. Words such as secure, private, or confidential need a useful explanation in context. Ask what the statement means for the record, recipient, purpose, and period at issue.

Before you proceed, list the questions still open. Name the file and the answer you need. Seek qualified help if the issue concerns your legal rights or a refusal you dispute. This general article cannot decide that issue for you.

A careful privacy review ends with a clearer understanding of the relationship. It should tell you what you are being asked to share, who will receive it, what the disclosed limits are, and where unanswered questions remain. It does not need a numerical ranking to be useful.

Frequently Asked Questions

Does a public privacy policy prove a DST provider is secure?

No. It states what the firm says it does. It does not prove how systems work or who has opened a file. Use it to ask clear questions and find the firm responsible. We read two public pages; we did not test the firms' systems.

Should I send every requested financial document right away?

First clarify the purpose, timing, receiving entity, and approved route. Ask whether the document is needed for the current step and whether an accepted alternative exists. Do not alter a required document based only on a general article. The provider's process and your decision about the relationship determine what happens next.

Does unsubscribing delete my investor records?

Do not assume so. Stopping sales emails and deleting a file are different actions. Ask about each, along with account access and records the firm must keep. Match each reply to the request it answers. One completed task does not show that all the others are done.

Do all DST companies keep records for six years?

No universal rule is established here. FINRA Rule 4511's six-year provision applies to specified FINRA books and records without another stated period, and it applies to member firms. The applicable rule can differ by entity and record type. Ask for the basis, duration, and starting event for your particular record.

Does removing a document from the portal erase every copy?

A portal change alone does not prove that. Ask whether the response covers working copies, outside service providers, required archives, and backups. Some records may remain for a stated reason. The important point is to understand the scope of the action rather than infer complete deletion from what is visible on screen.

Can I let my accountant use my account login?

Ask the firm for its proper process for authorized helpers. Clarify what access is available, whether it can be limited, and how it ends. Do not assume sharing your own login is the intended method. Permission to view information and permission to change or download it should be understood separately.

Is an older policy date proof of a privacy problem?

No. It identifies the date displayed on that page. Ask whether it is the current applicable notice and whether another entity or service has a separate policy. An older date alone does not establish outdated practices, just as a recent date alone does not prove that controls were tested.

What should I keep after asking for a correction or deletion?

Keep the request, the relevant policy version, the response, and any stated limits in an appropriate place. Record which categories were changed or retained and who handles follow-up. Avoid copying sensitive contents into a general comparison sheet. A precise outcome record is more useful than a broad label such as completed.

About Sequoia Research

Sequoia Research, LLC provides independent research on DSTs and other real estate investment offerings. This educational library explains research methods, evidence limits, and questions investors can discuss with their advisers. Its examples do not replace a review of a specific offering or an investor's circumstances.

Sources