Last updated October 13, 2026
Rupt is a fraud and account security platform. Most of the personal data we handle belongs to our customers' end users, and we process it only on their instructions. This policy explains what we collect, why, how long we keep it, and who else is involved.
Sabil, Inc., doing business as Rupt, is a Delaware corporation. "Rupt", "we" and "us" mean that company. "The service" means the Rupt API, SDKs, challenge pages and dashboard.
As a processor. When a business integrates Rupt, we receive data about that business's end users to answer fraud and account security questions for it. That business decides why and how the data is processed, and we act only on its instructions. If you are an end user of a site that uses Rupt, the business you were using is your first point of contact.
As a controller. When someone signs up for a Rupt account, visits rupt.dev or contacts us, we decide how that data is handled.
When a customer calls the Rupt API, our SDK takes measurements in the browser or app and sends them with the request:
Two features process more only when a customer enables them. Identity verification reads an identity document and performs a face liveness and comparison check. Content moderation classifies text an end user has submitted.
When you create a Rupt account we collect your name, email address, company details and billing information. On rupt.dev and the dashboard we collect usage analytics and may record sessions to diagnose problems. That recording never runs in the Rupt SDK, on our customers' sites, or on the challenge pages end users see.
Where a customer enables identity verification, we process biometric data to confirm that the person presenting a document is the person pictured on it. We keep no facial image and no face template. The comparison consumes the selfie in the same request that reads it, and there is no face search across users. Consent is recorded for each verification. Fields read from the document are retained in encrypted form so the customer can review a decision and detect the same document reused across accounts.
We engage a small number of vendors to run the service: cloud hosting and database providers, network infrastructure, IP intelligence, and, only when a customer enables the feature, identity verification, message delivery and text classification providers. Each is bound by contract to process data only on our instructions. Customers can request the current list, with what each vendor receives, by writing to us.
We also disclose personal data where the law requires it, and in a merger, acquisition or sale of assets, in which case we will tell you before your data becomes subject to a different policy.
Evaluation records, signals, risks, IP associations, challenges and identification requests expire 180 days after they are written. The database enforces this itself, so expiry does not depend on our application code running. A shorter period can be agreed for your project.
Device, fingerprint and user records that let the service recognise a returning device persist while the customer's account is active, because that recognition is the function the customer asks us to perform. They are deleted when the customer deletes the user or closes the account.
Rupt account data is kept for the life of the account and as long afterwards as tax, accounting and legal obligations require.
The service runs in the United States and we do not currently offer hosting elsewhere. If you use the service from outside the United States, your data is transferred there.
Data is encrypted in transit and at rest. Identity document fields are additionally encrypted with AES-256-GCM. Identifiers used to link a person across accounts are stored as keyed hashes that cannot be reversed, and are compared only within a single project.
No system is completely secure. If personal data under our control is compromised, we will investigate, notify affected customers without undue delay, and support their own notification obligations.
If you are an end user of a site that uses Rupt, the business running that site controls your data. Contact it to access, correct, delete or object. When it asks us to action a request, we do. We can act on a request you send us directly, but we will normally need to verify it with the business first.
If you hold a Rupt account or have dealt with us directly, you may ask us to access, correct, delete or port your data, and may object to or restrict how we use it. Write to support@rupt.dev. We respond within the period your jurisdiction requires and will not treat you differently for asking. Depending on where you live you may also appeal our decision or complain to your data protection authority or state attorney general.
Where the GDPR or UK GDPR applies and Rupt is a controller, we rely on performance of our contract with you, our legitimate interest in securing our own service, and your consent for optional analytics. Where we are a processor, our customer determines the legal basis. Fraud prevention is recognised as a legitimate interest in recital 47 of the GDPR.
Our use of cookies and similar storage is described in our cookie policy. The service is not directed at children and we do not knowingly collect data from anyone under 13. If you believe a child's data has reached us, write to us and we will delete it.
We update the date at the top of this page when this policy changes and tell customers directly when a change is material.
Sabil, Inc. (dba Rupt)
2445 Augustine Dr, Suite 150, Santa Clara, CA 95054, United States
support@rupt.dev