Security at Rupt
You send us signals about the people using your product. Here is what we do with them, where they live, and how to reach us about it.
Compliance
SOC 2
We are preparing for a SOC 2 audit and do not yet hold a report. Until we do, we will not claim one. Ask us and we will walk you through the controls we run today.
GDPR
Rupt acts as a processor for the data you send us. A data processing agreement and our current sub-processor list are available on request.
How your data is handled
- In transit and at rest
- Every request to the Rupt API is encrypted in transit. Stored data is encrypted at rest.
- Identity matching
- Person matching runs on keyed HMAC indexes rather than the underlying values, so the same person resolves consistently across evaluations without the original being readable from the database. KYC document fields are encrypted individually with AES-256-GCM.
- Retention
- Evaluation data expires 180 days after it is written, enforced by the database itself. A shorter period can be agreed for your project.
- Access
- Access to production is limited to the engineers who need it, and Enterprise plans get role-based permissions for your own team.
Where Rupt runs
Rupt runs on Google Cloud, in a single region in the United States. That is true of the API, the hosted challenge pages, and the datastores behind them.
If a privacy assessment or a regulator requires your data to be processed somewhere else, tell us where and we will scope it with you. Get in touch and we will send the sub-processor list and our DPA alongside it.