1. Intake
An authenticated person or connected agent sends a question and review material over TLS. The request names one workspace, workflow, and frozen review policy.
Security and procurement
One current evidence package, its data flow, and the gaps a buyer should see before asking.
Security facts v1.1 · reviewed 30 September 2026
Download dated PDFStart with the evidence
Data processing addendum
Article 28 terms, processing instructions, deletion, audits, and transfers.
Technical measures
Each stated control, the evidence behind it, and its current boundary.
Subprocessors
Providers, purposes, feature conditions, and the change-notice process.
Service status
Current service state and the availability claims RateLoop does not make.
Evidence verification
How to verify signed review evidence without trusting the RateLoop application.
Privacy notice
Roles, purposes, disclosures, retention, and data-subject information.
Data flow at a glance
Review material is scoped to the workspace and assigned invited reviewers. The Alpha accepts only public, synthetic, or safely redacted material.
2. Gate
RateLoop checks authorization, audience, publishing permission, and any allowance before delivery. Browser sessions are hashed and HttpOnly; workspace API credentials are stored as hashes.
3. Store and deliver
Service data uses the providers named in the subprocessor list. Designated private fields and objects use authenticated envelope encryption. Reviewers receive only assigned material.
4. Result and evidence
RateLoop returns an aggregate outcome and signed evidence. The packet omits reviewer identities and raw rationales and applies the frozen privacy threshold.
What the package supports
Scoped access
Authorization is checked per workspace and project. Reviewer invitations expire, and member removal ends workspace access.
Bounded encryption claim
TLS protects transport. Authenticated envelope encryption covers designated private fields and objects, not every database column.
Inspectable review evidence
Signed evidence and hash-chained audit records make covered review and management events independently checkable; they do not prove that every possible action was recorded.
Known gaps
No certification or attestation
RateLoop holds no SOC 2, ISO 27001, ISO 42001, HIPAA, or residency attestation.
No penetration-test report
There is no third-party penetration-test report in the standard package.
Recovery procedure not exercised
A restore procedure is documented, but no execution is recorded against the hosted deployment.
No continuous operational alerting
Structured failure events exist, but no log drain or alert rule consumes them today. RateLoop therefore states no detection time.
Questionnaires and audits
Use this page and the dated PDF as the standard first response. For a customer-specific questionnaire or an audit request, send the exact questions and required deadline through Support. Answers are limited to the deployed configuration and available evidence; a request does not create a certification or a missing report.
Open SupportScope of this package
The RateLoop public Alpha is a testing environment. This package describes that deployed testing system. It is not evidence of commercial production readiness, legal compliance, or certification.