Rippit Trust Center
Rippit is committed to the security of our customers and their data. Here is how we protect information and comply with industry standards and regulations.
See Resources

Compliance

Rippit security and compliance certifications, attestations, policies and security reports apply across our entire organization, covering all core processes, infrastructure, and applications.

SOC 2 Type 2

Service Organization Controls (SOC 2) (Type II) - Security, Confidentiality and Privacy

ISO 27001

ISO/IEC 27001 information security, cybersecurity and privacy protection

ISO 42001

We are proud to share that our team is fully aligned with the requirements of ISO/IEC 42001 for AI management systems, demonstrating our commitment to trustworthy, and secure AI practices.

PCI

PCI DSS 4.0 Level 1 Service Provider AOC

HIPAA

Type 1 Attestation (AT-C 105, AT-C 205 and AT- C 315) HIPAA / HITECH

GDPR

Protect the personal data and privacy of EU and UK citizens for transactions that occur within EU member states and UK

CCPA

California Consumer Privacy Act, is legislation designed to improve the data privacy of California residents

AWS Qualified Software / Partner

Rippit has successfully completed the AWS Foundational Technical Review (FTR), validating our solution against AWS best practices for security, reliability, and operational excellence.

Company Overview

Rippit, formerly MaestroQA, was founded in 2013 and is based in New York City. Rippit is the Growth Data Platform: one place where every team, and every AI agent they use, works from all of a company's data.

Customers range from small and medium businesses to Fortune 500 enterprises, including DraftKings, Fanatics, Acorns, SeatGeek, Notion, Brex and Harvey.

Product Description

Rippit connects to the tools where company data lives, such as Zendesk, Intercom, Salesforce, Gong and Snowflake, and to files and data customers upload. AI reads every record and saves the results as tables in the customer's workspace.

Teams ask questions in plain English, build Agent Apps that run on a schedule and send results to tools like Slack, email, Notion and Drive, and use Rippit from AI assistants such as Claude, ChatGPT and Cursor over MCP.

Security

Keeping customer data safe is our priority. Rippit is built on AWS across multiple availability zones, encrypts data at rest and in transit, and limits data access to authorized personnel. AI analysis runs through the managed providers listed under Subprocessors.

Bug Bounty

We partner with HackerOne to run a private bug bounty program to help surface and resolve security vulnerabilities before they can be exploited.

AWS-Validated Solution for Your Business

Rippit has officially received AWS Foundational Technical Review (FTR) Validation making us an officially certified AWS Partner. This validates our alignment with AWS's highest standards of security, reliability, and operational excellence.

What this means for our customers:

  • Trust: AWS Qualified Software and Partner Badges ensure credibility.
  • Reliability: Built on AWS best practices for seamless performance.
  • AWS Ecosystem Alignment: Listed on AWS Partner Discovery Portal and Solutions Finder.

Compliance

Rippit security and compliance certifications and attestation reports are linked in the resources section below. The certifications and attestation reports apply across our entire organization.

Privacy Documents

Acceptable Use Policy: Link to Rippit Acceptable Use Policy

Cookie Policy: Please refer to the Resources section.

Security Contact: [email protected]

Rippit Privacy Policy

Data Processing Addendum (DPA): Rippit's standard Data Processing Addendum governing the processing and protection of customer personal data, including applicable international data transfer provisions. View Rippit Data Processing Addendum

Monitoring

Continuously monitored by Secureframe

Resources

SOC 2 Type 2 Report

Security, Confidentiality and Privacy Criteria; Period - October 1, 2024 - September 30, 2025

ISO27001 Certificate

Current Certificate valid until: January 6, 2028

ISO42001 Certificate

Current Certificate valid until: November 5, 2028

PCI DSS 4.0 AOC

Level 1 Service Provider

HIPAA report

Information Security Policy

Penetration Test Report

Data Flow & Network Diagram

Rippit Cookie Policy

Subprocessors

Amazon Web Services

Cloud hosting, infrastructure, and managed AI services (including Amazon Bedrock, where applicable). Available regions: US and EU

MongoDB

Data Processing

Coralogix

Monitoring operations of Rippit Services

Fullstory

Product analytics and debugging - no end user data shared

Google Cloud Platform

Enabling Gemini as an LLM provider for in-product services. Data shared only if using Gemini as LLM provider.

Data location: US

Monitoring

Change Management

Software Change Testing
Software changes are tested prior to being deployed into production.
Secure Development Policy
A Secure Development Policy defines the requirements for secure software and system development and maintenance.
Configuration and Asset Management Policy
A Configuration and Asset Management Policy governs configurations for new sensitive systems
Change Management Policy
A Change Management Policy governs the documenting, tracking, testing, and approving of system, network, security, and infrastructure changes.
Production Data Use is Restricted
Production data is not used in the development and testing environments, unless required for debugging customer issues.

Organizational Management

Personnel Acknowledge Security Policies
Internal personnel review and accept applicable information security policies at least annually.
Information Security Program Review
Management is responsible for the design, implementation, and management of the organization’s security policies and procedures. The policies and procedures are reviewed by management at least annually.

Confidentiality

Data Retention and Disposal Policy
A Data Retention and Disposal Policy specifies how customer data is to be retained and disposed of based on compliance requirements and contractual obligations.
Data Classification Policy
A Data Classification Policy details the security and handling protocols for sensitive data.

Incident Response

Incident Response Plan
An Incident Response Plan outlines the process of identifying, prioritizing, communicating, assigning and tracking confirmed incidents through to resolution.

Risk Assessment

Risk Assessment and Treatment Policy
A Risk Assessment and Treatment Policy governs the process for conducting risk assessments to account for threats, vulnerabilities, likelihood, and impact with respect to assets, team members, customers, vendors, suppliers, and partners. Risk tolerance and strategies are also defined in the policy.
Risk Assessment
Formal risk assessments are performed, which includes the identification of relevant internal and external threats related to security, availability, confidentiality, and fraud, and an analysis of risks associated with those threats.
Vendor Risk Management Policy
A Vendor Risk Management Policy defines a framework for the onboarding and management of the vendor relationship lifecycle.

Access Security

Unique Access IDs
Personnel are assigned unique IDs to access sensitive systems, networks, and information
Access to Product is Restricted
Non-console access to production infrastructure is restricted to users with a unique SSH key or access key

Communications

Privacy Policy
A Privacy Policy to both external users and internal personnel. This policy details the company's privacy commitments.