Trust Center
What procurement needs to know, in one place
Every statement on this page is backed by evidence, and what we don't have — like a SOC 2 certification — is stated plainly instead of implied. The legal pages remain canonical; this page assembles them for vendor review.
Last reviewed July 22, 2026 · Next scheduled review January 22, 2027
Security
- All traffic to ruleboardai.com is served over HTTPS/TLS on Vercel's managed infrastructure.
- The website operates no database of its own. Form submissions are delivered by email and are not stored in any RuleboardAI-operated data store.
- All public forms use server-side validation, HTML-escaping of submitted values, and honeypot spam protection.
- RuleboardAI follows security-conscious, SOC 2-aligned practices but is not currently certified under SOC 2, ISO 27001, or any similar framework, and does not claim otherwise.
Privacy
- The product is built around data minimization: preliminary profiles are produced from public sources and require only four inputs (company name, website, public/private status, ticker).
- RuleboardAI does not sell or monetize personal or client data.
- Contact-form submissions are retained for 24 months, then deleted or anonymized — or sooner on request to privacy@ruleboardai.com.
- Website analytics use Plausible — cookieless and aggregate — plus Vercel Speed Insights for anonymized performance metrics. Neither builds visitor profiles.
Data handling
- Inquiry and intake submissions flow: browser → validation and spam checks → transactional email via Resend → the RuleboardAI notification inbox, which is the storage of record.
- Regulatory digest signups are stored as contacts in a Resend audience and used only to send the digest.
- Preliminary profiles never access client systems or internal documents. Deeper review happens only under a signed Letter of Authorization.
AI & model use
- Ruby, the site's chat assistant, is powered by Anthropic's Claude via API. Messages you type in the chat are sent to Anthropic to generate a response; the assistant answers from a fixed public knowledge base and escalates to a human at support@ruleboardai.com.
- AI-assisted workflows in report production run behind defined human-review points: classification sign-off, finding review, escalation handling, and monitoring-update review. Nothing ships straight from automation.
Business continuity
- The website is a static front-end on Vercel's globally distributed infrastructure; no RuleboardAI-operated server is a single point of failure for it. Deliverables are produced and delivered by email, so report delivery does not depend on website availability.
Incident response
- In the event of a security incident affecting personal data, RuleboardAI will investigate, take reasonable steps to contain and remediate, and notify affected individuals as required by applicable law.
Responsible disclosure
- Report suspected vulnerabilities to security@ruleboardai.com. Reports are acknowledged and legitimate issues addressed promptly; please allow a reasonable remediation window before public disclosure.
Data flow
What happens to information you submit
You submit
Contact & intake forms, chat, digest signup
Validated
Server-side validation, honeypot spam check, HTML escaping
Delivered by email
Resend → RuleboardAI notification inbox (storage of record)
Retained ≤ 24 months
Then deleted or anonymized
Deleted on request
privacy@ruleboardai.com
Chat messages additionally go to Anthropic to generate Ruby's replies. Digest signups are stored in a Resend audience. Card payments happen on Stripe-hosted checkout pages — payment details never touch this site.
Explicitly excluded
- No selling or monetizing of personal or client data
- No client-system access for preliminary profiles
- No RuleboardAI-operated database behind this website
- No cookie-based tracking or visitor profiling in analytics
Subprocessors
The complete list of service providers that process data for RuleboardAI, verified against what the product actually integrates — nothing speculative.
| Provider | Purpose | Data processed | Location |
|---|---|---|---|
| Vercel | Website hosting and delivery | Standard web request data (IP, user agent) | United States (global edge) |
| Resend | Transactional email and digest audience | Form submissions; digest signup email addresses | United States |
| Stripe | Card payment processing (Stripe-hosted checkout) | Payment details you enter on Stripe's checkout pages | United States |
| Anthropic | Chat assistant (Ruby) response generation | Messages typed into the site chat | United States |
| Plausible Analytics | Cookieless website analytics | Aggregate, anonymized usage data | European Union |
Provider
Vercel
Purpose
Website hosting and delivery
Data processed
Standard web request data (IP, user agent)
Location
United States (global edge)
Provider
Resend
Purpose
Transactional email and digest audience
Data processed
Form submissions; digest signup email addresses
Location
United States
Provider
Stripe
Purpose
Card payment processing (Stripe-hosted checkout)
Data processed
Payment details you enter on Stripe's checkout pages
Location
United States
Provider
Anthropic
Purpose
Chat assistant (Ruby) response generation
Data processed
Messages typed into the site chat
Location
United States
Provider
Plausible Analytics
Purpose
Cookieless website analytics
Data processed
Aggregate, anonymized usage data
Location
European Union
Documents for vendor review
Statuses are honest: what exists is linked, what we'll produce on request is marked, and what we don't hold says so.
GDPR/CCPA rights, data categories, and processors.
Service description, billing, and the not-legal-advice boundary.
The canonical security page — this Trust Center summarizes it.
RCPS Methodology & Scoring Standards
Versioned methodology behind every report.
Published on this page.
Security questionnaire responses
We complete reasonable vendor-security questionnaires on request.
SOC 2 report
RuleboardAI is not SOC 2 certified and does not claim to be. We follow SOC 2-aligned practices; ask us about the current posture.
Running a vendor review?
Request procurement documents or send a security questionnaire — we respond within one business day.
Procurement & vendor review: support@ruleboardai.com
Security: security@ruleboardai.com
Privacy requests: privacy@ruleboardai.com