Trust
Trust
One place for the documents a security or procurement review asks for. Each statement below is described in full on the security page.
Documents and pages
System status
What is working now, read live from the platform, with 90 days of uptime per component and the incident history.
Security
The controls built into the platform and how to report a vulnerability.
Privacy policy
What personal data we process, why, for how long, and your rights.
Data processing agreement
How we process personal data on your behalf, and how to get a signed copy.
Sub-processors
The sub-processors we use, and how we tell you before adding or replacing one.
Controls in the platform
- Every account's rows sit behind row-level security that the database enforces. Automated tests try to read across accounts on every table.
- Multi-factor authentication is required for administrators and can be required for everyone.
- Channel and provider credentials are never stored in plain text. Credentials typed into the console are sealed in a secret vault with a data key per account, and every use is audited.
- API tokens are scoped. Webhooks are signed with HMAC-SHA-256 and a timestamp.
- Usage is prepaid and capped, and high-cost number ranges are always refused.
- Audit records cover configuration changes, act-as sessions and reviews.
Audits and certifications
We do not hold third-party security certifications yet. When an audit or certification is completed, it will be listed on the security page with its scope and date.
Reporting a vulnerability
E-mail security@ringura.com. We acknowledge a report within 3 working days. The full policy is on the security page.
Reporting abuse
If a number or a message from our platform is being misused, e-mail abuse@ringura.com. Authorities send legal requests to the same address. How we handle both is on the security page.
Security questions for your review?
We will answer your questionnaire.