Security & Compliance

Security we can prove — and a clear account of what we can't yet

RapidReady Command protects your operational data with database-enforced access rules, evidence integrity records, and an explicit list of what is still being verified. If a claim isn't provable today, it isn't on this page.

Where we stand right now

Tenant isolation

Probe built, not yet run

Encryption

Platform-provided — reference pending

Certifications

None claimed — SOC 2 policies approved 2026-10-17, no auditor yet

Uptime

Own check every 15 min — see Status page; no SLA

How we protect your data

Access control

Every record read passes through database-level row-level security rules keyed to the signed-in user, not through the screen. Roles decide what a person can do; the rules decide what a person can see.

  • Row-level security enforced at the database, not only in the interface
  • Role-based permissions per action
  • Access and permission changes write an audit record
  • In progress: every write rule scoped to the reader's own company

Tenant isolation

Each company's records are separated by rules on the record set itself, so isolation does not depend on the interface hiding anything. We are building the cross-company test that proves it — until it has run, we describe isolation as enforced, not as verified.

  • Per-company separation at the record layer
  • A caller-run isolation test exists and attempts reads, writes, updates and deletes against another company's records
  • No shared record sets between companies
  • Not yet claimed: automated cross-company audit results

Audit and evidence integrity

Permission changes and evidence captures write an audit record, and evidence chain-of-custody entries carry SHA-256 hashes so that tampering can be detected rather than assumed absent.

  • Audit records on access and permission changes
  • SHA-256 evidence chain-of-custody
  • Tamper detection on legal evidence exports
  • Retention and deletion controls you configure

Encryption and secrets

Transport and at-rest encryption are provided by the hosting platform. We do not publish algorithm specifics on this page until we cite the platform's own documentation here.

  • Transport encryption provided by the hosting platform (documentation reference pending)
  • Encryption at rest provided by the hosting platform (documentation reference pending)
  • Credentials and API keys held as application secrets, never in code
  • File storage for customer evidence is being moved off public URLs — in progress

Compliance readiness

We do not claim certifications we do not hold. Compliance work is tracked, and any customer can ask us for the current state in writing.

  • SOC 2: our 14 written security policies were approved on 2026-10-17. No auditor is engaged yet, so we have no SOC 2 report and no certification.
  • Privacy practices follow data minimisation and scoped access — no GDPR or CCPA compliance conclusion is drawn here
  • Consumer and data-subject requests supported through a documented process
  • Data retention and deletion controls

Infrastructure security

The platform runs on managed cloud infrastructure. We publish only what we can measure, and we do not promise uptime figures we do not track.

  • Managed hosting with platform-level patching
  • Our own health check runs every 15 minutes; the results are on the public Status page (/status). No uptime promise (SLA) is offered
  • No claim of geographic redundancy until the hosting arrangement is documented here
  • Security reports answered by the team — see below

What we have not proven yet

  • •Cross-company isolation is enforced by rules and is being tested; we will publish the result when the test has run, pass or fail.
  • •Evidence files are being moved from public links to private storage with time-limited access; that work is not finished.
  • •No uptime promise, redundancy or certification claim is made on this page while it is unproven. The Status page shows our own checks, not an outside audit.
  • •The platform's question-answering surfaces are largely rules-based today. We describe them as rules-based rather than as AI until a model is actually in the path.

Ask us for the current state of any item above and we will answer in writing.

Status: our own health checksRoadmap and known limits

Our data commitments

We never sell your data

Your operational data, guard information, and client details are yours. We never sell, share, or license your data to third parties.

You control retention

Data retention policies let you control how long records are kept. Archived records are excluded from active queries and deleted on the schedule you set.

Scoped by design

Access is scoped to a person's role and company, and data exports are recorded in the audit trail.

Report a security vulnerability

If you've discovered a potential security vulnerability, we want to hear from you. Use the form below to send us the details — reports go directly to the team that maintains the platform. We aim to acknowledge reports within one business day and provide updates as we investigate.

Please do not disclose the vulnerability publicly until we've had time to investigate and remediate.

Security inquiry?

Enterprise customers and prospects — ask us anything about our security posture.

Privacy notice: we collect your email and message to answer your security inquiry or report. We do not sell or share your personal information. How long we keep it and your rights (including to know, delete and correct): Privacy Policy.

Security you can ask us about.

Start a 14-day free trial — no credit card required.