Security
What actually protects your data
This page describes measures that are implemented today, not a roadmap. The same list is a contractual commitment in section 8 of our Data Processing Agreement, so you can hand it to a client’s procurement team.
Rampsight is operated by one person, which means there is no security department to point at — and no reason to be vague. What we do not have yet is listed further down, on the same page.
Measures in place today
Your agency's account data, your clients' details and the scan results we hold for you are covered by all of the following.
Encryption in transit
Every connection runs over TLS: your browser to the application, the application to the database, and the application to every provider it talks to.
An EU database, encrypted at rest
All customer data lives in a database hosted in the EU (Frankfurt), with encryption at rest provided by the hosting platform.
Passwords and sessions
Passwords are stored only as salted bcrypt hashes — we cannot read yours, and neither can anyone with database access. Sessions are signed JWTs in httpOnly cookies, so page scripts cannot read them.
Integration secrets encrypted
Secrets you give us for integrations — a Jira API token, for example — are encrypted at rest with AES-256-GCM under a key derived from a server secret. They are decrypted only at the moment they are used.
API keys stored as hashes
A public API key is stored only as a SHA-256 hash. The raw key is shown once, at creation, and never again; if it is lost, you revoke it and create another.
Strict tenant isolation
Every query is scoped to the agency in your session. An id in a request body is never trusted on its own, so a request cannot reach another agency's client, site, scan or issue by guessing an identifier.
The scanner cannot reach your network
Before any scan, the target address is checked: private, loopback and link-local addresses are refused. The scanner cannot be pointed at an internal system, ours or yours.
Outbound calls are allow-listed
Integrations may only call hosts on an allow-list — hooks.slack.com for Slack alerts and *.atlassian.net for Jira. A URL you paste that is not on it is rejected, at every layer that handles it.
Public report links carry a token
A shared report or hosted statement is protected by an HMAC token in its link. Changing an id in the URL does not open somebody else's report.
Payments never touch our servers
Our merchant of record processes the payment: card details are entered on its side and we never see or store them. We keep only what an invoice needs — your company details.
Backups that expire
The database provider takes regular encrypted backups. Residual copies of deleted data expire within 90 days, which is also what the DPA commits us to.
Least-privilege access
Only the operator and the systems that run the service can reach production data, over authenticated channels. There is no shared admin console and no third party with a standing login.
Where your data is processed
These are the providers that process customer data on our behalf. The list is the same one incorporated by the Data Processing Agreement, and we give 14 days’ notice before it changes.
| Provider | Purpose | Location |
|---|---|---|
| Vercel | Web application hosting | Global edge network |
| Supabase | Database (all customer data) | Frankfurt, EU |
| Railway | Scan worker and PDF rendering infrastructure | EU |
| Resend | Transactional email (sign-in, password reset, notifications) | Ireland, EU |
| GoDaddy | DNS and email routing | Global |
The merchant of record handles payments as an independent controller, not as a subprocessor, so it is not in the table. Rampsight is operated from Brazil, which means the operator may access personal data from outside the EEA for support and maintenance; that access happens under the European Commission’s Standard Contractual Clauses, incorporated into the Data Processing Agreement.
What we do not have yet
Everything below is something a larger vendor may be able to show you and we cannot. You should know it from this page rather than from a procurement questionnaire — and we will never claim a certification we do not hold.
- Not included: A SOC 2 report
- Not included: An ISO 27001 certification
- Not included: Two-factor authentication on accounts
- Not included: An independent penetration test
None of these are refusals in principle; they are things a one-person company has not done yet. If one of them is a requirement for a client of yours, tell us — knowing which one blocks a deal is how it gets prioritised.
Reporting a security problem
If you find a vulnerability, email security@rampsight.com. There is no bug bounty and no legal ambush either — a clear report gets a clear answer. If our free scanner crawled a site you own and you would rather it did not, write to abuse@rampsight.com and we will block the domain.
1
Send what you found
Describe the issue and how to reproduce it. Please do not test against other customers' data, and do not run load or denial-of-service tests.
2
We answer within two working days
The person who reads it is the person who can deploy the fix, so there is no triage layer in between.
3
We tell you what changed
You get the outcome and, where a fix is shipped, when it went live. If customer data was affected, the DPA commits us to notifying affected customers within 48 hours of becoming aware.
The contractual version of this page
Everything described here is written into the Data Processing Agreement your agency accepts, together with the subprocessor list, the breach notification deadline and the deletion periods.