Trust and Security

Compliance status

• SOC 2 Type I: in progress. Initial controls implementation complete; attestation report expected Q3 2026. Engaged with a recognised SOC 2 platform for evidence collection and policy templates.
• UK / EU GDPR: full compliance with Articles 17 (erasure) and 20 (portability) shipped via in-product flows — see “Your rights” below.
• CCPA: California residents have the same export + deletion rights as EU users; honour requests within 30 days.
• ISO 27001: not yet pursued; on the roadmap once SOC 2 Type II completes.

Encryption & key management

• Transport: TLS 1.2+ enforced on every public surface. HSTS preload pending; included in security headers today.
• At rest: AES-256 encryption on the Postgres tier (Railway-managed) and on Resend / Stripe sub-processors.
• Application-layer encryption: sensitive fields encrypted with envelope encryption per the backend’s field-encryption module. Keys rotated quarterly.
• Passwords: bcrypt cost factor 12. Plaintext passwords never logged or persisted.
• API tokens: 32-byte cryptographically random; revocable via the database when leaked.

Data residency

Primary application data (users, projects, cost estimates, audit logs, billing references) is stored in EU-region Railway Postgres (europe-west4). Sub-processors that operate outside the EU (Resend, Sentry, Anthropic) have Standard Contractual Clauses in place.

We do NOT replicate primary data to a US region. Disaster-recovery snapshots stay within the EU. Customers with stricter residency requirements (e.g. UK-only) should contact [email protected].

Sub-processors

Every third-party service that processes customer data on our behalf, with the data it processes, its location, and a link to its data-processing agreement. Customers are notified 30 days in advance of any addition or material change.

Backup & incident response

• RTO (Recovery Time Objective): 4 hours.
• RPO (Recovery Point Objective): 24 hours (Railway daily snapshot cadence).
• Backup retention: ≥ 30 days for production Postgres.
• Restore drill: quarterly (next: 2026-08-23). Procedure documented internally; high-level summary in this page.
• Incident response: all production errors flow to Sentry with sanitised payloads. Sev-1 incidents (customer-facing outage) trigger an immediate ack to [email protected] and a public post-mortem within 5 working days for any user-impacting event ≥ 30 minutes.

Your rights (GDPR Art. 17 + 20)

All Rhino Intelligence users have the right to access their data, port it elsewhere, and have it permanently deleted. Both flows are self-service from your account settings:

• Export (Art. 20 portability): from /settings/account → “Download my data”. An emailed link valid for 24 hours returns a single JSON document with every piece of personal data we hold.
• Erasure (Art. 17): from /settings/account → “Delete my account”. Submission triggers admin review within 5 working days; approval starts a 30-day grace period (cancellable from the same screen while pending). After the grace period, all personal data is anonymised — only an unlinkable hashed reference remains on audit-log entries (regulatory necessity).
• Manual requests: if the self-service flow is unavailable, email [email protected]. We respond within 5 working days.

Vulnerability disclosure

We welcome responsible-disclosure reports from security researchers. The full policy is published at /legal/security-disclosure and summarised below.

Data Processing Agreement

Enterprise customers can request our standard DPA template by emailing [email protected]. The template covers the requirements of UK / EU GDPR Article 28 and is based on the European Commission’s Standard Contractual Clauses (Module 2: transfer controller-to-processor).

Custom DPAs are accommodated for Organization-tier contracts via Contact Sales.