Your business data. Protected by design.
Rufio runs dedicated infrastructure for every operator. Your data is never co-mingled with another operator's.
infrastructure
Dedicated per-operator infrastructure. Not shared tenancy.
Most SaaS platforms run all customers on a shared database and shared compute. If one account is breached, the blast radius can extend to others.
Rufio doesn't work that way. Each operator gets a dedicated database instance and isolated compute environment. Your data has its own storage, its own encryption keys, and its own access boundary. A compromise of another operator's environment cannot reach yours.
This is not a roadmap item. It is how Rufio was built from day one.
protections
How we protect your data.
Encryption at rest
All data stored on Rufio infrastructure is encrypted using AES-256. Database volumes, object storage, and backups are encrypted at rest. Encryption keys are managed per-operator and rotated on a scheduled basis.[CONFIRM: confirm key rotation schedule]
Encryption in transit
All data in transit between your browser (or phone) and Rufio is encrypted using TLS 1.3 or better. Internal service-to-service communication within the Rufio stack is also encrypted in transit.
Access controls
Rufio uses organisation-based permissions. Access to your account is role-gated — different team members can be given different permission levels.[CONFIRM: confirm role permission levels available at launch (e.g. owner / admin / member)]
All authenticated sessions use short-lived tokens. We maintain audit logs of administrative actions within your account.[CONFIRM: confirm audit log availability — accessible to operators or internal-only?]
Infrastructure hardening
Rufio runs on Railway, a managed cloud platform with SOC 2 Type II certification.[CONFIRM: confirm Railway SOC 2 status — link to their report]Production environments are network-isolated. Access to production systems is restricted to authorised Rufio engineers and requires multi-factor authentication.
subprocessors
Third-party services we rely on.
The following subprocessors have access to operator data as part of delivering Rufio. Each is contractually bound to process data only for the stated purpose.[CONFIRM: confirm DPAs are executed with all listed subprocessors]
| Subprocessor | Purpose | Data location |
|---|---|---|
| OpenAI | AI language model inference for conversational features | USA |
| Anthropic | AI language model inference for conversational features | USA |
| Stripe | Payment processing and subscription management | USA / global |
| Twilio | SMS and voice communications routing | USA / global |
| OpenRouter | AI model routing and inference gateway | USA |
| Railway | Cloud infrastructure hosting and compute | USA |
| Inngest | Background workflow and job orchestration | USA |
| Garage v2 (self-hosted) | S3-compatible object storage — hosted on Railway | Self-hosted |
| Centrifugo (self-hosted) | Real-time messaging — hosted on Railway | Self-hosted |
compliance
Compliance — where we are and where we're headed.
Today
- Per-operator data isolation by architecture
- AES-256 encryption at rest
- TLS 1.3+ in transit
- Organisation-based access controls
- Audit logging for administrative actions
- Hosted on SOC 2 certified infrastructure (Railway)
Roadmap
- SOC 2 Type II (Rufio entity)[CONFIRM: confirm SOC 2 Type II roadmap timeline]
- HIPAA-eligible configuration[CONFIRM: confirm HIPAA roadmap — target industries?]
- Operator-managed encryption keys (BYOK)[CONFIRM: confirm BYOK on roadmap]
- Penetration testing report (annual)[CONFIRM: confirm pen testing schedule]
incidents
How we handle incidents.
Detection and response
We monitor infrastructure and application logs continuously for anomalous activity. Critical alerts are routed to our on-call rotation with response SLAs.[CONFIRM: confirm on-call rotation and response SLAs exist]
In the event of a confirmed security incident, we will notify affected operators within 72 hours of discovery, consistent with GDPR breach notification requirements.[CONFIRM: confirm 72-hour notification process is documented]
Vulnerability disclosure
If you discover a potential security vulnerability in Rufio, we ask that you report it responsibly before public disclosure.
Email security@strata19.com with details. We will acknowledge receipt within 48 hours and aim to resolve critical vulnerabilities within 14 days.[CONFIRM: confirm 48-hour acknowledgement and 14-day critical response timeline][CONFIRM: confirm canonical security email address]
We operate a good-faith safe harbour: researchers who follow responsible disclosure will not face legal action for their findings.[CONFIRM: confirm safe harbour policy with legal]
contact
Questions about security?
For security reports, questions about our security posture, or to request a security review as part of a procurement process:
security@strata19.com[CONFIRM: confirm canonical security email address]
For general product questions, use our contact page. For privacy-related requests, email privacy@strata19.com.[CONFIRM: confirm canonical privacy email address]