Security and compliance, built in
Security isn't a checkbox we added later — it's how the platform is architected. Dedicated isolation, encryption everywhere, and compliance-ready defaults from day one.
Rach Dev LLP protects your data with end-to-end encryption, a dedicated database per project, database-enforced access control, and audit-ready logging. Our architecture is designed to support GDPR, CCPA, HIPAA, and PCI obligations so you can deploy AI agents on sensitive data with confidence.
How we protect your data
The controls that run underneath every project, by default.
Encryption Everywhere
Data is encrypted in transit with TLS 1.2+ and at rest with AES-256. Keys are managed and rotated by the platform, not left to your application code.
Dedicated Tenant Isolation
Every project runs on its own dedicated PostgreSQL instance with guaranteed resources — no shared multi-tenant database where a noisy neighbor can read or degrade your data.
Row-Level Security
Authorization is enforced at the database layer with RLS policies tied to each authenticated user, so access rules can't be bypassed by a bug in application code.
Encrypted Backups & Recovery
Automated, encrypted daily backups with point-in-time recovery to any second within the last 30 days, stored in a separate availability zone from your primary database.
Audit Logging
Privileged actions and agent conversations are recorded in audit-friendly, exportable formats with configurable retention, so you always have a trail of what happened and when.
Access Controls
Role-based access, OAuth and SSO sign-in, and least-privilege defaults across the platform keep credentials and infrastructure access tightly scoped.
Compliance & standards
Where we stand today — stated honestly, including what's still in progress.
GDPR & CCPA
Configurable data-retention policies, right-to-deletion, and data-portability workflows help you meet GDPR and CCPA obligations for the data your agents handle.
HIPAA-Ready Architecture
Healthcare templates are built so agents never store protected health information (PHI) outside your HIPAA-compliant systems, with audit-compliant logging throughout.
PCI-Conscious Payments
Agents never store raw card numbers and integrate with PCI-compliant payment processors, keeping cardholder data out of the platform entirely.
SOC 2 Type II
We're actively building toward SOC 2 Type II. We'd rather tell you exactly where we are than imply a certification we don't yet hold — reach out for our current posture.
Security questions, answered
The questions security and procurement teams ask us most.