Security

Your documents

Files upload from the borrower's device straight into your own Google Drive or OneDrive. We store only the paperwork about the paperwork: a file's name, when it arrived and which checklist item it satisfied.

Encryption

• Every connection to Rakolto is encrypted in transit.
• Our database is encrypted at rest.
• On top of that we encrypt the most sensitive fields ourselves with keys held separately from the database: drive authorization tokens, your private notes on contacts, and the sign-in links we email.
• Sign-in codes and upload-link passwords are stored only as one-way hashes.

Isolation between workspaces

Each workspace's data is separated at the database level: every request runs with the workspace it belongs to, and the database itself refuses to return another workspace's rows, even if application code were to ask.

Least privilege

Our application connects with a restricted database role that cannot create tables, change another tenant's data, or edit the records of what you have accepted. Background jobs use their own, narrower role. Secrets live in the hosting platform's environment, never in our code.

Backups and breaches

Our database provider keeps encrypted point-in-time backups for disaster recovery. If a breach affects your personal data, we will tell you and the relevant authorities within the time the law requires.

Security questionnaires

If your compliance team needs a vendor security questionnaire, a copy of our Data Processing Agreement or answers to specific questions, email security@rakolto.com and we will respond directly.

Reporting a vulnerability

If you believe you have found a security issue, email security@rakolto.com with what you found and how to reproduce it. Please give us a reasonable time to fix it before sharing it, and do not access data that is not yours. For privacy questions, email privacy@rakolto.com.