Security is a core part of how we build and operate the Rayz AI platform. This page describes the controls we use to protect the data you entrust to us.
Security program
We maintain a security program designed to protect the confidentiality, integrity, and availability of customer data. The program covers policies, training, access management, and continuous monitoring across our infrastructure.
Encryption
- In transit — all traffic to and from our services is encrypted with TLS 1.2 or higher.
- At rest — customer data is encrypted at rest using industry-standard AES-256 encryption.
- Key management — encryption keys are stored separately from the data they protect, with strict access controls and rotation.
Access controls
Access to customer data is restricted to employees who need it to perform their role. We enforce least-privilege access, multi-factor authentication, and background checks for roles with elevated access. Access is logged and reviewed periodically.
Vulnerability management
We continuously scan our infrastructure for vulnerabilities, run regular penetration tests, and maintain a coordinated disclosure process for security researchers. Critical issues are prioritized for immediate remediation.
Incident response
We maintain an incident response plan that covers detection, containment, and recovery. In the event of a security incident affecting your data, we will notify affected customers without undue delay, consistent with our legal obligations.
Compliance
We align our controls with widely recognized security frameworks, including SOC 2. We are committed to helping our customers meet their compliance obligations and provide documentation, such as our DPA, on request.
Reporting a vulnerability
If you believe you have found a security issue, please report it to security@rayz.ai. We appreciate responsible disclosure and will respond promptly.
