Security at Rize

Every change to Rize ships through peer-reviewed pull requests — there are no direct pushes to production code. Automated test suites run on every change across the API, web, and desktop applications, and schema-altering database changes are gated by tooling that blocks unsafe migrations and requires human review.

Releases deploy to a staging environment first. Production deployments are a deliberate, human-gated step with staged rollout and a clean rollback path. Secrets are stored in a managed secret store, never in code.

Rize runs layered, recurring security testing rather than point-in-time checks:

• Static analysis (SAST): Brakeman scans our Rails backend and Semgrep scans our JavaScript and TypeScript applications weekly.
• Dynamic analysis (DAST): OWASP ZAP scans run weekly against a production-equivalent environment.
• Dependency scanning: automated audits of every package ecosystem we use, with managed dependency updates.
• Penetration testing: an independent third-party vendor performs an annual grey-box test of the web application, API, and integration surfaces. All findings from the most recent test have been remediated and verified.

Confirmed vulnerabilities from any source — scanners, penetration tests, monitoring, or external reports — are tracked to closure with severity-based remediation targets: 7 days for critical issues, 30 days for high, and 90 days for moderate. Fixes ship through the same reviewed, tested release process as all other changes, and closures are verified by the next scan cycle.

To report a vulnerability, email support@rize.io. We appreciate responsible disclosure and respond to every report.

Rize maintains a documented incident management and response policy with four severity levels, a named incident lead, and defined steps for containment, evidence preservation, remediation, and post-incident review. Detection is continuous through error monitoring, log aggregation, and infrastructure alerting.

If an incident results in confirmed exposure of customer data, we notify affected customers without undue delay and within 72 hours, and notify regulators where the GDPR or CCPA requires it.

All connections to Rize require TLS 1.2 or higher — TLS 1.0 and 1.1 are rejected at our network edge, which also restricts weak cipher suites. Web traffic is HTTPS-only with HSTS.

Rize runs on Google Cloud Platform in US regions. Customer data is encrypted at rest with Google-managed keys, databases use automated backups, and production access is limited to authorized personnel through role-based access controls.

Rize is privacy-first by design: no keystroke logging and no stored screenshots — by default the desktop app reads only active-window metadata. Retention limits are enforced in code, not just policy: optional Screen Text data is deleted within 30 days of capture, and account data is purged after subscription closure.

Full details on what we collect and how it is used are in our Privacy Policy. A Data Processing Agreement is available at app.rize.io/dpa.

Rize is in an active SOC 2 Type II audit covering Security, Availability, and Confidentiality. The controls described on this page are in place and operating today; the audit evidences them over time.

Available to customers and prospects on request: penetration test executive summary, security policy documentation, and (under NDA) full penetration test reports and detailed scan results. Email support@rize.io.