Security Policy

Last updated: August 11, 2026

Security is the product at Ruligent — a governance tool has to hold itself to the standard it enforces. This page describes our current practices honestly, including what we do not yet have. For a product-level overview, see /security.

1. Encryption in transit

All traffic to www.ruligent.com — the marketing site, dashboard, and API — is served over HTTPS/TLS. Strict security headers and locked-down CORS are applied to all responses.

2. Credential handling

• API keys and session tokens are stored only as SHA-256 digests; keys are shown exactly once at creation and can never be retrieved afterward.
• Passwords are hashed with scrypt. We never store or log plaintext passwords.
• Stripe webhooks are signature-verified; we store no card data.

3. Tenant isolation

Every database query is scoped to the authenticated organization. There is no cross-tenant data path in the application: audit events, policies, approvals, spend data, and webhooks are all partitioned by org.

4. Signed webhooks

Outbound webhooks carry an X-Ruligent-Signature header — HMAC-SHA256 with a per-endpoint secret and timestamp tolerance — so your systems can verify that events genuinely came from Ruligent and are not replays.

5. Kill switches and control model

Kill switches operate org-wide, per-agent, and per-tool, and take precedence over every other control in the decision pipeline. They are a containment mechanism, not a safety guarantee: only actions routed through the gate can be killed, and you remain responsible for your agents (see the Terms of Service).

6. Data retention and purging

Audit events are automatically purged when they age out of your plan's retention window (7 days Free, 30 days Founder, 180 days Operator, 1 year Business). Account data is deleted on request. Details in the Privacy Policy.

7. Infrastructure

Ruligent is hosted on Vercel with data stored in Supabase (Postgres). The full subprocessor list, with locations and purposes, is at /legal/subprocessors. Optional error reporting (Sentry) and analytics (PostHog) are configurable and off by default in privately deployed deployments.

8. Responsible disclosure

We welcome security reports. Please follow the disclosure process in contact Ruligent. Report vulnerabilities privately; do not test against other customers' data. We commit to acknowledging reports promptly and keeping reporters informed through remediation.

9. Certifications — an honest note

Ruligent does not yet hold SOC 2, ISO 27001, or similar certifications. We will not claim compliance we do not have. As the company matures we intend to pursue formal audits; until then, this page, the subprocessor list, and the open-source core on contact Ruligent are offered for your own review. Enterprise customers with specific requirements should contact www.ruligent.com/contact.