Trust Center
One place for how Ruligent handles security, data, and disclosure — written honestly, including what we do not have yet. For the technical detail behind these controls, see the Security overview. Have a questionnaire? Send it over.
Security posture
Tenant isolation on every query, SHA-256-hashed API keys and scrypt-hashed passwords, TLS everywhere, HMAC-SHA256-signed webhooks, Stripe-only payments, and a fail-closed kill switch that outranks every rule. Full detail on the Security overview.
Data handling
The guard API stores a bounded summary of tool-call payloads for the audit trail — not raw payload bodies. Audit events expire on your plan's retention window and are purged automatically by a scheduled sweep. Telemetry is opt-in and receives ids and metadata, not payload contents.
Subprocessors
We keep a current list of the third parties that process data on Ruligent's behalf (hosting, database, payments, optional transactional recovery email, and error reporting). See Subprocessors.
Responsible disclosure
Report a vulnerability to www.ruligent.com/contact. Our machine-readable policy lives at /.well-known/security.txt; the full policy is in Security Policy.
SOC 2 controls mapping
Ruligent is not SOC 2 or ISO 27001 certified — see the maturity notes below. This table maps common SOC 2 Common Criteria control areas to what Ruligent actually does today, and marks the gaps as Roadmap or notes the use a private deployment mitigation. It is a transparency aid, not an attestation.
| Control area (SOC 2 CC) | What Ruligent does today | Status |
|---|---|---|
| Logical access — authentication (CC6.1) | scrypt-hashed passwords with per-user salts; SHA-256-hashed API keys shown once; hashed session tokens with 30-day expiry, revoked on logout. Optional Google/GitHub SSO with signed-state CSRF protection. | In place |
| Logical access — authorization (CC6.1, CC6.3) | Every query scoped to the org resolved from the credential. Two roles (admin/member); admin-only mutations return 403 insufficient_role. Kill-switch activation is asymmetric (any member activates, only admins deactivate). |
In place |
| Encryption in transit (CC6.7) | TLS on all hosted traffic; HSTS in production. Outbound webhooks signed HMAC-SHA256 with a timestamp. | In place |
| Encryption at rest (CC6.1) | Credentials stored only as hashes. Row data encryption at rest depends on the database provider (e.g. managed Postgres); Ruligent does not add application-layer field encryption. | Provider-dependent / Private deployment option |
| Audit logging (CC7.2) | Every guarded call is logged with agent, tool, action, input summary, decision, reason, risk, cost, and approval outcome — filterable and exportable (CSV/JSON on Business). Approvals are append-only with reviewer identity. | In place |
| Change management (CC8.1) | Reviewed changes, automated tests, governance checks, and production-readiness gates run before launch. Formal segregation-of-duties evidence and third-party attestation remain roadmap items. | Partial / Roadmap |
| Incident response (CC7.3, CC7.4) | Responsible-disclosure channel (security.txt + SECURITY.md); best-effort acknowledgement and severity-ranked fixes. A formal, tested incident-response runbook with defined SLAs is on the roadmap. | Partial / Roadmap |
| Vulnerability management (CC7.1) | Minimal dependency surface (zero-dependency SDKs); dependency audit on the production tree. Continuous scanning and periodic third-party penetration testing are roadmap items. | Partial / Roadmap |
| Vendor / subprocessor management (CC9.2) | A published subprocessor list and a DPA incorporated into the Terms. Payments run on Stripe; card data never touches Ruligent. | In place |
| Availability & backups (A1.2) | Hosted on managed infrastructure with provider-level backups; a scheduled maintenance sweep handles retention, approval expiry, and session cleanup. Ruligent does not yet publish an RPO/RTO or a tested restore attestation. | Provider-dependent / Roadmap |
| Confidentiality / data minimization (C1.1) | Payload summaries are bounded (not raw bodies); retention-based purging is automatic; telemetry carries ids/metadata only. | In place |
| Network / abuse protection (CC6.6) | Deny-by-default CORS, per-org and per-caller rate limits, webhook SSRF denylist, strict security headers and a same-origin CSP on static pages. | In place |
Honest maturity notes
Trust pages should say what is true, not what sounds good:
- No certification yet. Ruligent does not hold SOC 2, ISO 27001, or any other third-party attestation. The table above is a self-reported controls mapping for transparency — it is not an audit, a certification, or a promise of one. If your procurement requires an attestation today, contact us to evaluate a private deployment and an internal security review; no third-party certification is implied.
- Scope of governance. Ruligent governs the agent actions that pass through the gate. It cannot control actions your agents take without consulting it — instrument coverage matters, and the safety-check tool reports risky tools it has seen with no gating policy.
- Your responsibility. Ruligent provides controls, logs, and governance tooling. It does not guarantee your agents are safe, correct, or compliant with laws applicable to your use.
See also: Security overview, Security Policy, Subprocessors, Privacy Policy, Data Processing Addendum, security.txt.
Have a security or vendor questionnaire?
Send it over — answering them honestly is part of the product.