How Rippit protects your data
How Rippit handles the credentials and data that come through your integrations and AI tools.
SOC 2 Type IIPlus ISO 27001 and ISO 42001
EncryptedAt rest, in transit and in backups
No model trainingYour data is only used to answer you
Integrations
Credentials
- Real-time credentials are encrypted at rest (AES-256-GCM). Only the Rippit web app holds the key, and agents can’t decrypt them
- Each run gets short-lived credentials that expire within minutes and are never saved or logged
- Saved credentials are never shown again, and disconnecting deletes them
- Bulk ingest credentials are tested before saving
Sign-in safeguards
- Sign-in requests can only be used once and expire
- A source account that’s already connected to your workspace can’t be connected again
- Rippit can only read what the connected account can read, so use a dedicated account
Data leaving Rippit
- Anything Rippit sends to a connected tool, including lookups, leaves Rippit and can include conversation content and findings. Scope the tool’s credentials accordingly
- Rippit adds no required approval step before a write tool that’s on. Treat connected tools like any other place you export data
Shared connections
- A connection acts as the account that signed in
- Shared, everyone in your organization and every scheduled Agent App gets that access. Admins confirm this before saving
Rippit in your AI tools
Sign-in
- OAuth 2.1 with PKCE. People sign in at app.rippit.com, and their password never reaches the assistant
- Short-lived tokens tied to Rippit’s server, refreshed automatically
- Tokens carry identity only. Every request is checked against the person’s current access, and removing someone in Rippit ends their access at the next refresh
Access
- There’s no service account or admin scope that gets around your workspace permissions
- Access to a conversation is all or nothing: if someone can open it, their assistant gets the full transcript and ticket fields, including personal details
- Hiding a column hides it from table reads but not from full transcripts
What’s stored and logged
- Rippit’s server has no database or file store. Transcripts, rows and results aren’t written, cached or logged
- It logs who used which tool, when, for how long and whether it worked. Never request content
- Worksheets and files your assistant creates are saved in your Rippit workspace
Registration and limits
- Assistants that register themselves are limited to the standard Rippit scope. Unused registrations expire after 1 hour and can be revoked
- Assistants that register themselves show as “unverified” on the consent screen, which is expected
- Requests are rate-limited per person and must match strict formats. Responses are size-capped. TLS 1.2 or newer
- Rippit adds no approval step before writes. Claude and ChatGPT let admins require approval per tool
Your data
Hosting
- AWS, across multiple availability zones
- Encrypted at rest, in transit and in backups
- No other choice of data location is offered
Who processes it
- AWS (US and EU), MongoDB, Coralogix, Fullstory (no end-user data) and Google Cloud Gemini (US only, where used)
- Rippit doesn’t train AI models on your data. It’s only used to answer you
- Once data reaches an AI assistant, that vendor’s terms apply
Certifications
- SOC 2 Type II (Security, Confidentiality, Privacy), ISO 27001 and ISO 42001
- PCI DSS 4.0 Level 1 Service Provider
- HIPAA Type 1 attestation, GDPR and CCPA
Testing and agreements
- Regular penetration testing and a private bug bounty
- A DPA is available through the Trust Center, which also covers retention