Security at Rize

Every change to Rize ships through peer-reviewed pull requests — there are no direct pushes to production code. Automated test suites run on every change across the API, web, and desktop applications, and schema-altering database changes are gated by tooling that blocks unsafe migrations and requires human review.

Releases deploy to a staging environment first. Production deployments are a deliberate, human-gated step with staged rollout and a clean rollback path. Secrets are stored in a managed secret store, never in code.

Rize runs layered, recurring security testing rather than point-in-time checks:

• Static analysis (SAST): Brakeman scans our Rails backend and Semgrep scans our JavaScript and TypeScript applications weekly.
• Dynamic analysis (DAST): OWASP ZAP scans run weekly against a production-equivalent environment.
• Dependency scanning: automated audits of every package ecosystem we use, with managed dependency updates.
• Penetration testing: an independent third-party vendor performs an annual grey-box test of the web application, API, and integration surfaces. All findings from the most recent test have been remediated and verified.

Confirmed vulnerabilities from any source — scanners, penetration tests, monitoring, or external reports — are tracked to closure with severity-based remediation targets: 7 days for critical issues, 30 days for high, and 90 days for moderate. Fixes ship through the same reviewed, tested release process as all other changes, and closures are verified by the next scan cycle.

To report a vulnerability, email support@rize.io. We appreciate responsible disclosure and respond to every report.

Rize maintains a documented incident management and response policy with four severity levels, a named incident lead, and defined steps for containment, evidence preservation, remediation, and post-incident review. Detection is continuous through error monitoring, log aggregation, and infrastructure alerting.

If an incident results in confirmed exposure of customer data, we notify affected customers without undue delay and within 72 hours, and notify regulators where the GDPR or CCPA requires it.

All connections to Rize require TLS 1.2 or higher — TLS 1.0 and 1.1 are rejected at our network edge, which also restricts weak cipher suites. Web traffic is HTTPS-only with HSTS.

Rize runs on Google Cloud Platform in US regions. Customer data is encrypted at rest with Google-managed keys, databases use automated backups, and production access is limited to authorized personnel through role-based access controls.

Rize is privacy-first by design: no keystroke logging, and by default the desktop app reads only active-window metadata. Retention limits are enforced in code, not just policy: Vision is off by default and runs only if an admin enables it, its data is deleted 30 days after capture unless the workspace sets a different retention, Vision images are stored only if an admin enables Save images (also off by default), and account data is purged after subscription closure.

Full details on what we collect and how it is used are in our Privacy Policy. A Data Processing Agreement is available at app.rize.io/dpa.

Team admins see approved time entries: the title, description, times, client, project, rates and billable amount. Before an entry is approved, they see that time was tracked and for how long, but not the client or project. Entries the person hasn't touched are approved automatically 8 hours after their tracking day ends, unless an admin turns auto-approve off.

The activity behind an entry stays with the person who tracked it: app names, URLs, window titles, Vision screen summaries, calendar events and meeting transcripts. No admin can see another person's activity, in the app or through an integration.

Claude, ChatGPT, Zapier and API keys connect to Rize as a specific person:

• Same permissions as the person: a connection reaches only what its owner can reach in Rize, and any member can connect their own.
• Read and write: a connection can create, edit and delete the data its owner could change in the app.
• OAuth 2.0 with PKCE: required for every Claude, ChatGPT and Zapier connection. Revoke a connection from the connected app's settings, and delete API keys in Rize settings.
• AI providers: data Rize returns to Claude or ChatGPT is processed by Anthropic or OpenAI under your account's terms with them.

Rize has started its SOC 2 Type II engagement with security-consultant.com, covering Security, Availability, and Confidentiality. The controls described on this page are in place and operating today; the audit evidences them over time. Let us know if you have any questions.

Available to customers and prospects on request: penetration test executive summary, security policy documentation, and (under NDA) full penetration test reports and detailed scan results. Email support@rize.io.