Technical and organisational measures
This page explains the measures in Annex 1 of the data-processing agreement and the evidence currently available for each.
Access control
Opaque principals, hashed sessions, scoped API credentials, least-privilege workspace and project rights.
Every route checks workspace and project access. Reviewer invitations expire; removing a member ends their workspace access.
Revocation time across systems has not been measured; no deprovisioning time is claimed.
Encryption
TLS in transit, and authenticated envelope encryption at rest for designated private fields and objects.
Server-only wrapping keys are separated by tenant and purpose. An unavailable key withholds affected content.
Encryption at rest applies to the designated fields and objects, not to every column in the database.
Integrity and accountability
Hash-chained audit records, signed evidence, access logging, dependency controls, and separated roles.
Privileged actions append hash-chained audit records. Removing or editing a record breaks the chain. Operator, owner, admin, and member roles are separate.
No scheduled review or recorded attestation says who holds production access today. The chain does not prove anyone read the records.
Availability and recovery
Provider-managed backups outside the processing-region claim, bounded retry, and deletion reconciliation.
The documented restore procedure specifies the checks required for a usable restore.
No execution has been recorded against the hosted deployment.
Incident and vulnerability management
Security triage, dependency scanning, coordinated remediation, and a 48-hour breach-notification ceiling.
Operator-actionable failures emit structured events with an error class and digest, without private content.
There is no log drain and no alert rule. Host logs may expire before an operator reads them.
The restore drill
A drill restores into an isolated encrypted EEA environment, never into production. It counts as whole-service recovery only after the matching app and worker, storage, control planes, DNS, callbacks, keys, and providers pass. The same record must contain measured RPO/RTO, access revocation, and deletion evidence.
Database checks cover the schema version, core table row counts, audit-chain integrity, offline evidence verification, and measured restore duration.
Executions, including failures, remain in the record. Evidence expires after 365 days.
No execution has been recorded against the hosted deployment.
What this page does not claim
- RateLoop holds no SOC 2, ISO 42001, or HIPAA certification.
- No availability figure. Service status states the target.
- The audit trail covers recorded actions; it is not a complete record of every action.