Security overview
How the platform is built and operated, and what we do not claim.
Effective date: 2026-09-13 · Version: 1.0.0
Certifications we do not hold
We hold no security certification and have completed no third-party security audit. We are saying that plainly rather than letting the rest of this page imply otherwise, because a buyer discovering it during procurement costs both of us far more than reading it here.
If your review needs evidence rather than a badge, ask us and we will answer specific questions about how a specific control works.
Who can reach what
A Member can only reach their own organization's data. This is enforced on every request against the resource actually being requested, not assumed from which page a request came from.
Our own staff hold no standing access to customer data. A capability that touches it, such as resolving an erasure request made by contact address or reviewing an organization's declared residency region, is granted to a staff account individually, by permission, rather than by default, and every privileged staff action is written to the audit trail with who did it and when.
Encryption
Every connection to the platform is over HTTPS; a plain HTTP request is redirected to it rather than served. Data at rest, including the database and everything in it, sits on an encrypted disk volume.
What is recorded
Who changed what, and when, is recorded for the actions that matter to a team running this platform: changes to feature flags, environments, rollouts, guardrails, membership and roles. Records are kept for 7 years.
When someone exercises their right to erasure, the record itself is not deleted; deleting it would leave a hole in exactly the trail a compliance program depends on. Instead, the actor's identity on that record is replaced with an anonymous marker, so the record no longer identifies the person while the trail stays intact.
Monitoring
Availability is measured from the outside: an external probe checks the platform from multiple network locations on a fixed interval, independently of the instance it is checking, because a monitor that lives on the same instance it watches cannot see that instance go dark. Application logs, metrics and traces are collected continuously and held in our observability platform.
If something goes wrong
We investigate a suspected security incident as soon as we know about it, and act to contain it rather than waiting until the investigation is complete. If we confirm an incident affecting customer personal data, we tell affected customers without undue delay and in any case within 72 hours of becoming aware, with what is known at the time and updates as more becomes known, the same commitment stated in our data processing agreement.
Outside services
Every outside service that processes personal data on our behalf is named, with its purpose and processing location, on the subprocessor list.
Reporting a vulnerability
Write to privacy@rollfuse.com with enough detail to reproduce what you found. We will confirm receipt, and we will not pursue you for reporting it in good faith.