How your data is protected
Encryption, isolation, and access controls in plain language
The short version
You upload documents that may contain sensitive business information — the platform is built around that fact. The full details live on our Trust Center; here's the summary.
Encryption
- In transit — all traffic is encrypted with HTTPS/TLS 1.2+, with HSTS enforced.
- At rest — data is encrypted (AES-256) by our managed infrastructure providers: Neon for the database, Cloudflare R2 for file storage. Data is stored in the United States.
Organization isolation
Every organization's data is isolated. Every query is scoped to your organization at the application layer, with database row-level security as defense in depth. Other customers cannot see your questionnaires, documents, or answers — and AI features only ever retrieve content from your own workspace.
Account security
- Passwords hashed with bcrypt; never stored in plain text
- Mandatory email verification; secure HTTP-only session cookies
- Temporary lockout after repeated failed sign-ins; rate-limited login endpoints
- Role-based permissions — only owners touch billing; only owners and admins manage the knowledge base and team
Continuity and accountability
Security-relevant actions — logins, exports, team changes — are recorded in an audit log. The database takes daily snapshots with point-in-time recovery over a 14-day window.
A note on certifications
We describe our actual practices rather than claiming badges: RFI Know is not currently SOC 2 or ISO 27001 certified. If you need specific security documentation for your own vendor review, contact us.