Secure by design
Security decisions are made while a feature is being designed — not bolted on afterwards. New surfaces are reviewed for what data they touch and who can reach them.
Trust / Security
Built for business operations,
with clear boundaries.
RapidRoot automates the work around customer conversations — enquiries, bookings, reminders, payments — so boundaries matter more than badges. This centre explains how security, tenancy and product maturity are actually handled today.
Practices in place today are labelled. Planned work is labelled as planned. No invented SOC 2, ISO or HIPAA claims.
Product boundaries — what maturity means here
We reinforce trust by labelling honest state on every surface, including pricing and docs.
Available
Messaging
Shared inbox, campaigns, templates, analytics.
Pilot — guided access
Voice
Provider setup, KYC, qualification required.
Live — workspace
Hostels / PG
Property→Bed→Stay→Invoice→Payment.
Live — workspace
Real Estate
Projects→Inventory→Leads→Bookings.
In development
Automation
Cross-channel triggers & workflows.
Coming soon
AI Agents
Task agents on your data.
In place today
Encryption in transit
TLS 1.2 or higher on all dashboard and API traffic.
In place today
Role-based access
Workspace roles enforced on the server, not in the interface.
Planned
Multi-factor authentication
On the roadmap. Not available today.
Planned
Independent audit
No third-party audit or certification has been completed.
Six principles we design to
Plain-language rules that shape how features get built and how the platform is operated.
Least privilege
People and services get the narrowest access that lets them do their job. Credentials are scoped per environment and can be rotated or revoked.
Defense in depth
We assume any single control can fail. Network boundaries, application authorisation and workspace-level roles each enforce access independently.
Encryption
Traffic between customers, our dashboard and our APIs is encrypted in transit. Secrets are stored in managed secret storage rather than in source code.
Continuous monitoring
Application and infrastructure logs are collected so unusual behaviour and failures can be investigated rather than guessed at.
Responsible disclosure
We would rather hear about a problem than discover it later. Researchers can report issues directly and we will acknowledge and investigate them.
Operational boundaries, made explicit
Customer Operations means handling live workflows — messages, calls, stays and bookings. Trust comes from boundaries that are honest: who can access what, which data is isolated where, and where money movement is verified.
Identity & access
Individual accounts, workspace roles, server-enforced checks and rotatable, environment-scoped credentials. No shared logins for attribution.
Access controlTenant / organization isolation
Data is scoped to the workspace it belongs to. Every request is workspace-checked server-side — not trusted from the client. See Data protection & Infrastructure.
Payments
Hostel and Real Estate billing follows the existing backend implementation — payment verification and entitlements are server-side; no client-side amount trust. See Compliance roadmap.
Compliance roadmapExplore the trust centre
Each page covers one area in detail, and says plainly where a control does not exist yet.
Data protection
What data we hold, why we hold it, and how it is handled.
Encryption
Transport security and credential handling, at a high level.
Access control
Accounts, roles, sessions and authentication.
Privacy
A plain-language view of collection, purpose and control.
Infrastructure
Hosting, scaling, logging and monitoring architecture.
Reliability
Monitoring, incident detection and planned maintenance.
Backups & continuity
Backup strategy, recovery philosophy and continuity goals.
Incident response
How issues are reported, handled and communicated.
Responsible AI
Human oversight, transparency and appropriate AI use.
AI governance
How we intend to build and operate AI features.
Compliance roadmap
Current practices separated clearly from future goals.
Security FAQ
Common security, privacy and procurement questions.
Legal hub
Privacy Policy, Terms, Cookies and Acceptable Use.
Security contact
Reporting a vulnerability and what to expect.
Shared responsibility
RapidRoot secures the platform, its infrastructure and the APIs we operate. Customers are responsible for how they configure their workspace: who they invite, what data they route through the platform, how they store credentials, and whether their messaging has consent.
Messaging and voice delivery depend on third-party network and messaging providers, which operate under their own terms and security practices.
Coming to this trust centre
Space is reserved for documents we intend to publish. None of them exist yet, and we will not reference them as evidence until they do.
Security whitepaper
Planned — a deeper technical description of platform controls.
Architecture diagrams
Planned — detailed data-flow diagrams for security review.
Penetration test summary
Planned — will be published only if and when a test is performed.
Responsible AI report
Planned — periodic reporting on automated conversation quality.
Transparency report
Planned — incidents, availability and data requests over time.