# Security | Rippit Integration Docs

> How Rippit handles the credentials and data that come through your integrations and AI tools.

Canonical: https://www.rippit.com/integrations/docs/security

Contents

Security

# How Rippit protects your data

How Rippit handles the credentials and data that come through your integrations and AI tools.

**SOC 2 Type II**Plus ISO 27001 and ISO 42001

**Encrypted**At rest, in transit and in backups

**No model training**Your data is only used to answer you

### Integrations

### Credentials

-   Real-time credentials are encrypted at rest (AES-256-GCM). Only the Rippit web app holds the key, and agents can’t decrypt them
-   Each run gets short-lived credentials that expire within minutes and are never saved or logged
-   Saved credentials are never shown again, and disconnecting deletes them
-   Bulk ingest credentials are tested before saving

### Sign-in safeguards

-   Sign-in requests can only be used once and expire
-   A source account that’s already connected to your workspace can’t be connected again
-   Rippit can only read what the connected account can read, so use a dedicated account

### Data leaving Rippit

-   Anything Rippit sends to a connected tool, including lookups, leaves Rippit and can include conversation content and findings. Scope the tool’s credentials accordingly
-   Rippit adds no required approval step before a write tool that’s on. Treat connected tools like any other place you export data

### Shared connections

-   A connection acts as the account that signed in
-   Shared, everyone in your organization and every scheduled Agent App gets that access. Admins confirm this before saving

### Rippit in your AI tools

### Sign-in

-   OAuth 2.1 with PKCE. People sign in at app.rippit.com, and their password never reaches the assistant
-   Short-lived tokens tied to Rippit’s server, refreshed automatically
-   Tokens carry identity only. Every request is checked against the person’s current access, and removing someone in Rippit ends their access at the next refresh

### Access

-   There’s no service account or admin scope that gets around your workspace permissions
-   Access to a conversation is all or nothing: if someone can open it, their assistant gets the full transcript and ticket fields, including personal details
-   Hiding a column hides it from table reads but not from full transcripts

### What’s stored and logged

-   Rippit’s server has no database or file store. Transcripts, rows and results aren’t written, cached or logged
-   It logs who used which tool, when, for how long and whether it worked. Never request content
-   Worksheets and files your assistant creates are saved in your Rippit workspace

### Registration and limits

-   Assistants that register themselves are limited to the standard Rippit scope. Unused registrations expire after 1 hour and can be revoked
-   Assistants that register themselves show as “unverified” on the consent screen, which is expected
-   Requests are rate-limited per person and must match strict formats. Responses are size-capped. TLS 1.2 or newer
-   Rippit adds no approval step before writes. Claude and ChatGPT let admins require approval per tool

### Your data

### Hosting

-   AWS, across multiple availability zones
-   Encrypted at rest, in transit and in backups
-   No other choice of data location is offered

### Who processes it

-   AWS (US and EU), MongoDB, Coralogix, Fullstory (no end-user data) and Google Cloud Gemini (US only, where used)
-   Rippit doesn’t train AI models on your data. It’s only used to answer you
-   Once data reaches an AI assistant, that vendor’s terms apply

### Certifications

-   SOC 2 Type II (Security, Confidentiality, Privacy), ISO 27001 and ISO 42001
-   PCI DSS 4.0 Level 1 Service Provider
-   HIPAA Type 1 attestation, GDPR and CCPA

### Testing and agreements

-   Regular penetration testing and a private bug bounty
-   A DPA is available through the Trust Center, which also covers retention

## Your data and creativity is your edge. Put agents on it to maximize it.

Connect your data. Launch agents.

[Start free →](https://app.rippit.com/signup)[Book a demo](https://www.rippit.com/request-demo)

## Getting started from an AI agent

There are two ways to connect. Either works.

- MCP server: `https://mcp.rippit.com/mcp` (Streamable HTTP, OAuth). The person signs in or signs up in the browser that opens. No client ID, secret or API key is needed.
- CLI: install with `curl -fsSL https://rippit.sh | sh`, then get an account one of two ways:
  - `rippit login`: the person signs in or signs up in a browser.
  - `rippit start`: creates a temporary account with no email or browser, for a person with no Rippit account. `rippit claim --wait` lets them keep it; an unclaimed account is deleted after 14 days.

Then bring in data: connect a provider such as Zendesk, Intercom, Gong or Salesforce, or upload a CSV.

Full steps: https://www.rippit.com/setup.md