This page describes how RuleboardAI handles data and approaches security. We aim to state only what is true, and to describe our commitments conservatively rather than over-claim — which, for a compliance vendor, is the only honest way to write this page.
Data handling overview
The public website collects personal data in three places: its intake forms — contact, category request, and general inquiry — which take a name, email, optional phone number, company name and website, location, public/private status, ticker, and your message; the regulatory digest sign-up, which takes an email address; and the Ruby chat assistant, whose messages are processed to generate a reply (see Subprocessors below).
RuleboardAI is built around data minimization. We are designed to avoid retaining client compliance data wherever possible: we collect and process only what is necessary to deliver the service, we do not sell or monetize client data, and we retain as little as possible. Where the exact processing location is not yet finalized, we keep our commitments conservative rather than over-claim a specific technical architecture.
How we access your data
RuleboardAI operates on an authorization-first, non-custodial boundary. The distinction below is the single most common procurement question, so we state it explicitly:
- Preliminary profiles use public sources only. They are built from filings, registration records, enforcement databases, and public disclosures. They require no system integration, no database or API access, no IT configuration, and no document uploads. There is no institutional data of yours for us to hold at this stage; the contact details you submit through the site are handled as described above.
- Deeper review begins only with written authorization. Evidence-verified work requires a signed Letter of Authorization, and it does involve client-provided material. You decide when internal documentation enters scope, and which documents.
- Evidence state is never blurred. Public-source observations stay labeled public-source. Client-provided material stays labeled client-provided until it is verified. Nothing is silently promoted from one state to another.
Put plainly: “no system access” describes the preliminary profile, not every engagement. We will not claim that authorized, evidence-verified work happens without your documents — it cannot.
Hosting & infrastructure
The website is hosted on Vercel (website hosting and delivery). We keep the infrastructure that touches personal data as small as possible, and limit the data we collect to what the service requires.
Encryption
- In transit: all traffic to the website is served over HTTPS/TLS.
- At rest: any data stored by our hosting and form providers is protected by those providers' platform security controls.
Access control & least privilege
Access to the deployment platform and to contact-form submissions is limited to authorized personnel on a need-to-know basis, protected by strong authentication.
Subprocessors
We use a small set of third-party providers:
- Vercel — website hosting and content delivery.
- Form / email processor — Resend (transactional email delivery) used to send contact-form submissions to a RuleboardAI-operated mailbox, and to hold the regulatory-digest subscriber list.
- Stripe — card payment processing. Checkout happens on Stripe-hosted pages; payment details are entered there and never touch this website.
- Anthropic— powers Ruby, the site's chat assistant. Messages typed into the chat are sent to Anthropic's API to generate a response.
- Analytics — Plausible Analytics (privacy-first, cookieless, EU-hosted). It records aggregate, anonymous usage only; it sets no cookies, collects no personal data, and does not track visitors across sites.
The full subprocessor table, with what each provider processes, is maintained in the Trust Center.
Data retention & deletion
Contact-form submissions are retained for 24 months, then deleted or anonymized — or sooner on request. To request deletion of your data, email privacy@ruleboardai.com. See our Privacy Policy for full detail on your rights.
Our compliance posture
We follow security-conscious, SOC 2-aligned practices in how we build and operate the product. We are not currently certified under SOC 2, ISO 27001, or any similar framework, and we do not claim any certification we do not hold. We will state certifications here only once they are actually held, and will share supporting documentation under NDA on request.
Vulnerability reporting
If you believe you have found a security vulnerability, please report it responsibly to security@ruleboardai.com. We will acknowledge your report and work to validate and address legitimate issues promptly. Please do not publicly disclose a vulnerability before we have had a reasonable opportunity to respond.
Incident response
In the event of a security incident affecting personal data, we will investigate, take reasonable steps to contain and remediate it, and notify affected customers and any regulators as required by applicable law and contract, without undue delay.
Security contact
For any security or data-handling question, contact security@ruleboardai.com or use the contact form.