Security & Compliance

Security we can prove — and a clear account of what we can't yet

RapidReady Command protects your operational data with database-enforced access rules, evidence integrity records, and an explicit list of what is still being verified. If a claim isn't provable today, it isn't on this page.

Where we stand right now

Tenant isolation

Test being built; results will be published when run

Encryption

Platform-provided — reference pending

Certifications

None claimed — SOC 2 policies approved 2026-10-17, no auditor yet

Uptime

Own check every 15 min — see Status page; no SLA

How we protect your data

Access control

Every record read passes through database-level row-level security rules keyed to the signed-in user, not through the screen. Roles decide what a person can do; the rules decide what a person can see.

  • Row-level security enforced at the database, not only in the interface
  • Role-based permissions per action
  • Access and permission changes write an audit record
  • In progress: every write rule scoped to the reader's own company

Tenant isolation

Each company's records are separated by rules on the record set itself, so isolation does not depend on the interface hiding anything. We are building the cross-company test that proves it — until it has run, we describe isolation as enforced, not as verified.

  • Per-company separation at the record layer
  • A caller-run isolation test exists and attempts reads, writes, updates and deletes against another company's records
  • No shared record sets between companies
  • Not yet claimed: automated cross-company audit results

Audit and evidence integrity

Permission changes and evidence captures write an audit record, and evidence chain-of-custody entries carry SHA-256 hashes so that tampering can be detected rather than assumed absent.

  • Audit records on access and permission changes
  • SHA-256 evidence chain-of-custody
  • Tamper detection on legal evidence exports
  • A retention schedule that blanks personal details after set periods (switched on after legal review)

Encryption and secrets

Transport and at-rest encryption are provided by the hosting platform. We do not publish algorithm specifics on this page until we cite the platform's own documentation here.

  • Transport encryption provided by the hosting platform (documentation reference pending)
  • Encryption at rest provided by the hosting platform (documentation reference pending)
  • Credentials and API keys held as application secrets, never in code
  • New uploads are stored privately and opened with links that expire after one hour; some older files still have public links and are being moved

Compliance readiness

We do not claim certifications we do not hold. Compliance work is tracked, and any customer can ask us for the current state in writing.

  • SOC 2: our 14 written security policies were approved on 2026-10-17. No auditor is engaged yet, so we have no SOC 2 report and no certification.
  • Privacy practices follow data minimisation and scoped access — no GDPR or CCPA compliance conclusion is drawn here
  • Consumer and data-subject requests supported through a documented process
  • A retention schedule is built and previewed weekly; it is switched on only after legal review

Infrastructure security

The platform runs on managed cloud infrastructure. We publish only what we can measure, and we do not promise uptime figures we do not track.

  • Managed hosting with platform-level patching
  • Our own health check runs every 15 minutes; the results are on the public Status page (/status). No uptime promise (SLA) is offered
  • No claim of geographic redundancy until the hosting arrangement is documented here
  • Security reports answered by the team — see below

What we have not proven yet

  • •Cross-company isolation is enforced by rules. An automated test of it is being built and has not been run against live customer data; we will publish the result when it is run, pass or fail.
  • •New uploads go to private storage with time-limited links. Some files uploaded earlier still have permanent public links; moving them is not finished.
  • •No uptime promise, redundancy or certification claim is made on this page while it is unproven. The Status page shows our own checks, not an outside audit.
  • •The platform's question-answering surfaces are largely rules-based today. We describe them as rules-based rather than as AI until a model is actually in the path.

Ask us for the current state of any item above and we will answer in writing.

Status: our own health checksRoadmap and known limits

Our data commitments

We never sell your data

We never sell your data. We share it only with the service providers listed in our Data Processing Addendum. See the list (Annex 3)

Archive, export and retention

Archived records are kept out of everyday lists, and you can download a full export of your data at any time. A retention schedule that blanks personal and location details after set periods is switched on only after legal review.

Scoped by design

Access is scoped to a person's role and company, and data exports are recorded in the audit trail.

Report a security vulnerability

If you've discovered a potential security vulnerability, we want to hear from you. Use the form below to send us the details — reports go directly to the team that maintains the platform. We aim to acknowledge reports within one business day and provide updates as we investigate.

Please do not disclose the vulnerability publicly until we've had time to investigate and remediate.

Security inquiry?

Enterprise customers and prospects — ask us anything about our security posture.

Privacy notice: we collect your email and message to answer your security inquiry or report. We do not sell or share your personal information. How long we keep it and your rights (including to know, delete and correct): Privacy Policy.

Security you can ask us about.

Start a 14-day free trial — no credit card required.