Security at rtylr

Security Program

Voxire runs a formal information-security program aligned with the principles of ISO 27001 and SOC 2 Type II. It is maintained by our engineering leadership and reviewed quarterly. The program covers people, process, and technology controls across development, operations, and customer support.

Data Protection

Encryption in transit

All traffic between customer devices and rtylr is encrypted using TLS 1.2+ (strong cipher suites, perfect forward secrecy, HSTS enabled). We reject connections from legacy TLS versions.

Encryption at rest

Customer Data is stored on encrypted volumes (AES-256). Database-level encryption is enabled for all workspaces. Backups are also encrypted and stored in separate geographical regions.

Secrets management

API keys, tokens, and credentials are stored in a managed secrets vault, rotated on a regular schedule, and scoped to the minimum permissions required.

Infrastructure

rtylr runs on reputable cloud infrastructure with ISO 27001, SOC 2, PCI DSS, and GDPR attestations. Our primary providers include Cloudflare (edge), Firebase / Google Cloud (auth and managed services), and a managed database provider with automated failover.

• Production environments are isolated from staging and development.
• Multi-region backups with point-in-time recovery up to 7 days.
• Capacity planning and DDoS mitigation at the edge.

Access Control

Access to production systems is restricted to a named group of engineers, gated behind SSO with mandatory multi-factor authentication. We follow the principle of least privilege: engineers receive only the access they need, and access is reviewed at least quarterly.

All production access is logged with actor, action, and timestamp. Audit logs are retained for 12 months.

Application Security

• Authentication. Passwords are hashed with industry-standard algorithms; MFA is available for all accounts; sessions use httpOnly, Secure, SameSite cookies with short lifetimes.
• Authorization. Role-based permissions enforced server-side on every API call. No trust-the-client logic for sensitive actions.
• Input validation. All external input is validated with schema-level rules; dangerous sinks are avoided.
• CSRF, XSS, SQLi. Prevented through standard framework protections, parameterised queries, and strict content-security-policy headers.
• Rate limiting. Per-IP and per-user rate limits on public endpoints.

Vulnerability Management

• Dependencies scanned on every build; critical CVEs patched within 7 days.
• Container and image scanning in CI.
• Annual third-party penetration test; results and remediation evidence available under NDA for prospective Scale customers.
• Static analysis (SAST) on the main codebase.

Monitoring and Incident Response

We maintain 24/7 monitoring and alerting across infrastructure, applications, and authentication flows. Suspected incidents are triaged against a documented incident-response runbook. Customers affected by a security incident are notified in accordance with applicable law and, at minimum, within 72 hours of confirmation for material breaches.

Compliance and Certifications

• GDPR & UK GDPR, we act as processor for Customer Data, with DPA available on request.
• CCPA/CPRA, honored for California residents; opt-out mechanisms available.
• PCI DSS, payment processing is offloaded to Paddle, a Level-1 certified merchant of record.
• SOC 2 Type II, in progress; target completion Q4 2026.

Vendor Management

We vet sub-processors for security posture before onboarding, require data-protection agreements, and review major vendors annually. A current list of sub-processors is maintained and available via [email protected].

Responsible Disclosure

We welcome reports from security researchers. If you believe you’ve found a vulnerability, please email [email protected] with:

• a clear description of the issue and its impact;
• steps to reproduce;
• any proof-of-concept material (please do not exfiltrate data beyond what is needed to demonstrate the issue).

We commit to acknowledging receipt within 48 hours, working in good faith on a fix, and crediting you publicly once the issue is resolved (unless you prefer to remain anonymous). We do not take legal action against researchers acting in good faith under this policy.

Contact Security

For security questions, reports, or compliance requests, email [email protected]. For urgent issues, WhatsApp +961 3 940 708.