How we protect your data

• Encrypted in transit (TLS) and encrypted at rest.
• Hosting and storage inside the EU.
• Every customer logically separated in the database, enforced per row rather than per page.
• Access inside Riffle on a need-to-know basis, with two-factor authentication.
• Daily backups, and logging of every access to production systems.

This is also article 4 of the data processing agreement. There it is an obligation rather than a claim on a page.

Your data is not used to train anyone else’s models. We buy AI services only on business terms that rule it out.

Processing outside the EEA is covered by appropriate safeguards: the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses. The full subprocessor list is in the data processing agreement, and we announce a change to it 30 days in advance.

Agents can be wrong. That is why a person confirms whatever goes to a customer or into the accounts. It is not a disclaimer in the small print; it is how the product works.

We report a data breach within 48 hours of discovering it to the customer it affects, with what we know at that point: what happened, who it touches, and what we have done about it. That customer then decides on notifying the regulator and the people involved — they are the controller, not us.

If you spot something yourself, write to help@riffle.so with "security" in the subject. We answer on working days, we ask you not to publish until it is closed, and we will not hold it against you.

On request you get the information you need to demonstrate compliance. Once a year you may have an audit carried out by an independent expert, with 30 days’ notice and at your own cost.

Riffle is young, and we put nothing here that we cannot show you.

• No SOC 2 and no ISO 27001 certification.
• No guaranteed uptime and no guaranteed response time. Availability and support are best effort, and the terms say so.
• No third-party penetration test.

If one of these has to exist before you can work with us, say so in the first call. Then you know where you stand and we know whether to go and get it.