01 — Compliance status
Where we are, without rounding up.
Updated monthly. If a label here ever overstates our position, that's a bug — report it to security@rig.fyi.
| Framework | Status | Detail |
|---|---|---|
| SOC 2 Type I | complete | Completed Aug 2026. Report available under NDA. |
| SOC 2 Type II | in progress | Auditor engaged. Audit window Q4 2026; report expected on completion of the observation period. |
| HIPAA | BAA available | Business Associate Agreement available on Enterprise plans. |
| FedRAMP | roadmap | Targeted for 2027. Not authorized today — do not deploy us into a FedRAMP boundary. |
02 — Data flow
What we store, and what we never see.
| Question | Answer |
|---|---|
| what RIG stores | ProofPacket metadata: hashes (input, output, chain), run status, timestamps, agent/version identity, token counts, billing records. Hashes, not content. |
| what RIG never stores | On Enterprise on-prem: raw prompts and completions never leave your infrastructure — the runtime runs in your VPC and phones home hashes only. On cloud tiers, prompt content is processed in memory and discarded at seal; run logging of content is opt-in and off by default. |
| retention | Packets: account lifetime (they are the ledger). Optional run logs: 30 days on Pro, configurable on Enterprise. Audit logs: 7 years. Deleted-account data purged within 30 days. |
| encryption | TLS 1.3 in transit, everywhere, no exceptions. AES-256 at rest. Per-tenant key isolation on Enterprise. |
| region pinning | Workspace-pinned to us-east or eu-west. Packets, logs, and backups never leave the pinned region. |
03 — Subprocessors & paperwork
The short list.
Four subprocessors. That's the whole list — changes are announced 30 days ahead on this page.
| Subprocessor | Role | Location |
|---|---|---|
| AWS | Compute & storage | us-east-1 · eu-west-1 |
| Cloudflare | Edge, WAF, DNS | global anycast |
| Stripe | Billing | us |
| Postmark | Transactional email | us |
| Item | Availability |
|---|---|
| DPA | Data Processing Agreement available on request — legal@rig.fyi. |
| SSO | SAML / OIDC on Pro and above. |
| SCIM | Directory provisioning on Enterprise. |
Security contact: security@rig.fyi
04 — Access model
Isolation is the default, not the upsell.
| Control | Behavior |
|---|---|
| builder / verifier isolation | Builder and verifier runtimes hold disjoint credential sets. The verifier cannot assume the builder's identity; the builder cannot read the verifier's refutation context. Compromise of one side does not mint a seal. |
| scoped workspace tokens | Per-workspace, least-privilege scopes, independently rotatable. No token crosses workspaces; a leaked token's blast radius is one workspace's builders, never the govern plane. |
| audit-log export | Every read, write, seal, and token event is logged and exportable as JSON or CSV. SIEM-forwardable via webhook on Enterprise. |