Security & Compliance Program

Every control, and exactly where it stands.

RIDIER handles the most sensitive signal an organization has: what its people actually say. This page lists the full control inventory, its current status, and the roadmap to continuous monitoring and an independent examination. Nothing here is claimed as audited until an auditor has said so.

Our standing statement

RIDIER holds no SOC 2 report, ISO certification, or third-party attestation at this time, and we will not say otherwise. What follows is a factual inventory: controls built into the product, procedures documented, and work actively in progress. This page is maintained by Ridier Consultancy Group LLC and updated as items change.

Control inventory

Six domains, tracked line by line

Items marked In place are implemented and operating in the platform today. Items marked In progress are being built, documented, or evidenced now and will be confirmed once continuous monitoring is connected.

Data protection

How employee conversation data and customer data are protected in transit, at rest, and over time.

  • TLS encryption for all traffic in transitIn place
  • Encryption at rest through managed hostingIn place
  • Conversation content redacted or deleted after signal extractionIn place
  • Voice audio never written to storageIn place
  • Documented retention schedule per data categoryIn progress
  • Customer offboarding export and 30-day deletion procedureIn progress

Access control

Who can reach what, on both the leader side and the employee side.

  • Role-based leader authorization (owner, admin, analyst, viewer)In place
  • Server-side authorization check on every requestIn place
  • No role, including owner, can read transcripts or session-level signalsIn place
  • High-entropy employee access links stored as hashes onlyIn place
  • Link closure, revocation, rate limiting, and optional PINIn place
  • Written access control policy with quarterly access reviewsIn progress
  • Formal joiner/mover/leaver offboarding checklistIn progress
  • MFA evidenced on every administrative accountIn progress

Tenant isolation & privacy engineering

Separation between customers, and between employee voice and leader visibility.

  • Row-level security on every customer tableIn place
  • Minimum reporting thresholds before any result is shownIn place
  • Differencing protection across overlapping breakdownsIn place
  • No employee identity, raw IP, device ID, or persistent cross-session ID storedIn place
  • Research and evidence tables restricted to privileged server rolesIn place
  • Documented privacy impact assessmentIn progress

Application & AI security

How the platform and its language-model use are constrained.

  • AI and service credentials held server-side onlyIn place
  • Scores calculated by versioned deterministic formulas, never by a modelIn place
  • Leader insights generated from aggregate data onlyIn place
  • Input validation and rate limiting on all public endpointsIn place
  • Automated backend security scanningIn place
  • Dependency vulnerability scanning in the release flowIn place
  • Secure development policy (code review, change management)In progress

Governance & documentation

The written program behind the technical controls.

  • Privacy Policy, Terms, Data Processing Information, and Subprocessor list publishedIn place
  • Vulnerability disclosure contact publishedIn place
  • Incident Response Plan with severity levels and notification commitmentsIn progress
  • Data Retention & Deletion PolicyIn progress
  • Information Security Policy (master)In progress
  • Vendor management and subprocessor review policyIn progress
  • Annual documented risk assessmentIn progress
  • Security awareness training recordsIn progress

Operations & resilience

Keeping the service available and recoverable, with a record of what changed.

  • Managed hosting with provider-level redundancyIn place
  • Administrative audit log of owner and admin actionsIn place
  • Backup and restore procedure, tested and documentedIn progress
  • Business continuity and disaster recovery planIn progress
  • Annual incident-response tabletop exerciseIn progress

Frameworks

Where we stand against each framework

Readiness is not the same as an audit. These are our honest positions.

  • SOC 2 (Security, Confidentiality)

    Readiness work in progress. No examination has been performed and no report exists.

    In progress

  • Continuous compliance monitoring (Vanta or equivalent)

    Selected as the next step. Controls above will be mapped and evidenced once the platform is connected.

    In progress

  • GDPR / UK GDPR processor obligations

    Processing roles, purposes, retention, subprocessors, and security measures are published. No regulator or auditor has reviewed them.

    In progress

  • ISO/IEC 27001

    Not in scope for the current stage. No certification has been sought or obtained.

    Not obtained

  • HIPAA

    Out of scope. RIDIER is not a healthcare or clinical product and does not process protected health information.

    Not obtained

Roadmap

The sequence we are working through

Each phase has to close before the next one is meaningful. We will update this page as phases complete.

Phase 1

Publish the policy set

Privacy, terms, processing information, and subprocessors are live. Internal retention, incident-response, and access-control procedures are written and under final review.

Phase 2

Close the technical gaps

Administrative audit logging, tested backup and restore, dependency scanning in the release flow, and evidenced MFA across administrative accounts.

Phase 3

Connect continuous monitoring

Subscribe to Vanta or an equivalent platform, connect hosting, email, source control, and identity accounts, and remediate automated control failures.

Phase 4

Independent examination

Readiness assessment, then a SOC 2 Type I examination, followed by a Type II observation window. Report availability will be posted here under NDA.

Procurement and vendor review

Our privacy policy, terms, data processing information, and subprocessor list are published rather than gated, so a security review can start without a call. For a security questionnaire, a data processing agreement, or architecture detail, write to Executive@ridier.com.

Security & Trust Data ProcessingSubprocessors

Reporting a vulnerability

Email Executive@ridier.com with the details and steps to reproduce. Please do not access or modify data belonging to others, and give us reasonable time to respond before publishing. We acknowledge every report and keep you updated while we investigate. We do not currently operate a paid bounty program.

Talk to us about your security review

Bring your questionnaire. We will answer it straight.

We would rather tell you exactly what is built and what is not than hand you a badge.

Request a Demo