Trust and security

Where your data lives

When you create your organization you choose where its data is stored: the United States or the European Union. Everything for that organization (posts, files, the inbox, analytics and search) stays in that region, and the choice cannot be changed later. Owners see it under Organization → Data.

Encryption

• Everything travels over TLS 1.2 or later, and the app tells browsers to use HTTPS only.
• The access tokens for your social accounts, your notification webhook addresses and their signing secrets are encrypted with AES-256-GCM under a key that belongs to your workspace alone. Those keys are themselves encrypted and never written to logs.
• Tokens, keys and passwords are removed from our logs, traces and error reports automatically.

Keeping workspaces apart

Every workspace's data is separated in the database itself (row level security), not only in our code. Files and search indexes are kept per workspace too. Someone in one workspace asking for another's data gets "not found".

AI and your content

Your content is sent to our AI providers only to do the work you ask for, under terms that do not allow them to train their models on it. No model is fine-tuned on customer data.

The AI team's research reads public web pages about a topic. Research shared across customers in the same category is built from public data only, never from any customer's content, accounts or results.

If you connect your own key for an AI provider, the work you send to it goes to that provider under your own agreement with it.

What was sent to a model and what it wrote is deleted after 90 days; the record that a job ran, and what it cost in credits, stays.

How long we keep data

Before a workspace is deleted, its owner can export it (posts, comments, the history of every post and a list of its files, with a manifest). When it is deleted, its connected accounts are disconnected at the platforms, and its files, search index and encryption keys go with it.

Payments

Cards are entered only on pages hosted by Stripe (Checkout and the Customer Portal). Rezule never sees, stores or handles card numbers, which keeps us to the smallest PCI DSS scope (SAQ A).

Application security

• A strict Content Security Policy on the app, and the standard browser protections (no framing, no content sniffing, a strict referrer policy).
• Rate limits for every person and address, and stricter ones for sign-in and invitation links.
• Webhooks from platforms and Stripe are checked by signature before anything in them is read.
• Addresses you give us and files we fetch for you are reached only on the public internet, never inside our network.
• Uploaded files are checked by their contents, not their names.
• Dependencies are audited for known vulnerabilities on every change and updated weekly, and each release is scanned with OWASP ZAP.

When something goes wrong

We watch the service around the clock with alerts for publishing, the API, AI providers and security signals. Serious incidents get a response within 15 minutes. Incidents that affect you are posted at status.rezule.ai, with a written summary afterwards. If your personal data is ever affected, we tell you without undue delay, as the Data Processing Addendum sets out.

Reporting a vulnerability

Write to security@rezule.ai. We reply within two business days and do not take action against good-faith research.