Security

Ultima actualizare

Our Commitment to Security

At RENDA, security is fundamental to everything we build. We understand that you trust us with sensitive business data, and we take that responsibility seriously.

Infrastructure Security

Cloud Infrastructure

  • Hosted on enterprise-grade cloud providers with SOC 2 compliance
  • Geographically distributed data centers for redundancy
  • DDoS protection and traffic filtering
  • Regular infrastructure security assessments

Network Security

  • All traffic encrypted with TLS 1.3
  • Web Application Firewall (WAF) protection
  • Intrusion detection and prevention systems
  • Network segmentation and isolation

Data Protection

Encryption

  • In Transit: All data encrypted using TLS 1.3
  • At Rest: AES-256 encryption for stored data
  • Database: Encrypted connections and storage
  • Backups: Encrypted backup storage

Data Isolation

  • Strict tenant isolation in multi-tenant environments
  • Separate encryption keys per organization
  • Access controls enforced at all levels

Application Security

Secure Development

  • Security-focused code reviews
  • Static and dynamic application security testing
  • Dependency vulnerability scanning
  • Regular penetration testing by third parties

Authentication

  • Secure password hashing (bcrypt)
  • Multi-factor authentication support
  • Session management and timeout controls
  • OAuth 2.0 for third-party integrations

Access Control

  • Role-based access control (RBAC)
  • Principle of least privilege
  • Audit logging of all access
  • Regular access reviews

AI Security

Model Security

  • Secure API connections to AI providers
  • Input validation and sanitization
  • Output filtering for sensitive data
  • Rate limiting and abuse prevention

Data Handling

  • Content processed in memory, not persisted
  • No training on customer data without consent
  • Prompt injection protection
  • Response filtering

Operational Security

Monitoring

  • 24/7 security monitoring
  • Real-time alerting on anomalies
  • Log aggregation and analysis
  • Incident response procedures

Personnel

  • Background checks for employees
  • Security awareness training
  • Confidentiality agreements
  • Access revocation on departure

Compliance

Standards

  • GDPR compliant data handling
  • SOC 2 Type II (in progress)
  • ISO 27001 aligned practices

Data Residency

  • EU data center options available
  • Data localization compliance
  • Cross-border transfer safeguards

Incident Response

Response Process

  1. Detection and alerting
  2. Initial assessment and containment
  3. Investigation and root cause analysis
  4. Remediation and recovery
  5. Post-incident review

Notification

  • Prompt notification of security incidents
  • Regular updates during active incidents
  • Post-incident reports for affected parties

Vulnerability Disclosure

Responsible Disclosure

We welcome security researchers to report vulnerabilities:

  • Email: security@renda.ai
  • PGP key available on request
  • Response within 48 hours
  • Recognition for valid reports

Bug Bounty

Contact us for information about our security research program.

Security Best Practices for Users

Account Security

  • Use strong, unique passwords
  • Enable multi-factor authentication
  • Regularly review account access
  • Report suspicious activity immediately

Data Handling

  • Only upload necessary data
  • Use appropriate access controls
  • Regularly review sharing permissions
  • Delete data when no longer needed

Contact

For security questions or to report concerns: