Your business data. Protected by design.
Your business belongs to you. Rufio gives you a dedicated setup and clear controls over access and actions, so you can choose where its capabilities help.
You set the permissions
Powerful tools. The controls stay with you.
Choose what needs your approval.
Keep a task at Suggest to review and adjust the work before it happens. You can keep it there for as long as you like.
Set the rules for routines.
Authorize the work you want Rufio to handle, inspect the results, and adjust or pause the routine when your needs change.
Build and release on your terms.
Review a new form, tool, or workflow with Rufio. Change the details and decide when it is ready to use.
Your dedicated setup
Your business data, kept separate.
Most SaaS platforms run all customers on a shared database and shared compute. If one account is breached, the blast radius can extend to others.
Rufio doesn't work that way. Each operator gets a dedicated database instance and isolated compute environment. Your data has its own storage, its own encryption keys, and its own access boundary. A compromise of another operator's environment cannot reach yours.
This is not a roadmap item. It is how Rufio was built from day one.
protections
How we protect your data.
Encryption at rest
All data stored on Rufio infrastructure is encrypted using AES-256. Database volumes, object storage, and backups are encrypted at rest. Encryption keys are managed per-operator and rotated on a scheduled basis.[CONFIRM: confirm key rotation schedule]
Encryption in transit
All data in transit between your browser (or phone) and Rufio is encrypted using TLS 1.3 or better. Internal service-to-service communication within the Rufio stack is also encrypted in transit.
Access controls
Rufio uses organisation-based permissions. Access to your account is role-gated — different team members can be given different permission levels.[CONFIRM: confirm role permission levels available at launch (e.g. owner / admin / member)]
All authenticated sessions use short-lived tokens. We maintain audit logs of administrative actions within your account.[CONFIRM: confirm audit log availability — accessible to operators or internal-only?]
Infrastructure hardening
Rufio runs on Railway, a managed cloud platform with SOC 2 Type II certification.[CONFIRM: confirm Railway SOC 2 status — link to their report]Production environments are network-isolated. Access to production systems is restricted to authorised Rufio engineers and requires multi-factor authentication.
subprocessors
Third-party services we rely on.
The following subprocessors have access to operator data as part of delivering Rufio. Each is contractually bound to process data only for the stated purpose.[CONFIRM: confirm DPAs are executed with all listed subprocessors]
| Subprocessor | Purpose | Data location |
|---|---|---|
| OpenAI | AI language model inference for conversational features | USA |
| Anthropic | AI language model inference for conversational features | USA |
| Stripe | Payment processing and subscription management | USA / global |
| Twilio | SMS and voice communications routing | USA / global |
| OpenRouter | AI model routing and inference gateway | USA |
| Railway | Cloud infrastructure hosting and compute | USA |
| Inngest | Background workflow and job orchestration | USA |
| Garage v2 (self-hosted) | S3-compatible object storage — hosted on Railway | Self-hosted |
| Centrifugo (self-hosted) | Real-time messaging — hosted on Railway | Self-hosted |
compliance
Compliance — where we are and where we're headed.
Today
- Per-operator data isolation by architecture
- AES-256 encryption at rest
- TLS 1.3+ in transit
- Organisation-based access controls
- Audit logging for administrative actions
- Hosted on SOC 2 certified infrastructure (Railway)
Roadmap
- SOC 2 Type II (Rufio entity)[CONFIRM: confirm SOC 2 Type II roadmap timeline]
- HIPAA-eligible configuration[CONFIRM: confirm HIPAA roadmap — target industries?]
- Operator-managed encryption keys (BYOK)[CONFIRM: confirm BYOK on roadmap]
- Penetration testing report (annual)[CONFIRM: confirm pen testing schedule]
incidents
How we handle incidents.
Detection and response
We monitor infrastructure and application logs continuously for anomalous activity. Critical alerts are routed to our on-call rotation with response SLAs.[CONFIRM: confirm on-call rotation and response SLAs exist]
In the event of a confirmed security incident, we will notify affected operators within 72 hours of discovery, consistent with GDPR breach notification requirements.[CONFIRM: confirm 72-hour notification process is documented]
Vulnerability disclosure
If you discover a potential security vulnerability in Rufio, we ask that you report it responsibly before public disclosure.
Email security@strata19.com with details. We will acknowledge receipt within 48 hours and aim to resolve critical vulnerabilities within 14 days.[CONFIRM: confirm 48-hour acknowledgement and 14-day critical response timeline][CONFIRM: confirm canonical security email address]
We operate a good-faith safe harbour: researchers who follow responsible disclosure will not face legal action for their findings.[CONFIRM: confirm safe harbour policy with legal]
contact
Questions about security?
For security reports, questions about our security posture, or to request a security review as part of a procurement process:
security@strata19.com[CONFIRM: confirm canonical security email address]
For general product questions, use our contact page. For privacy-related requests, email privacy@strata19.com.[CONFIRM: confirm canonical privacy email address]