Trust center
Check our security yourself. Every item links to the proof.
Rendro is an early-stage, founder-led company. Instead of badges we don't have yet, this page lists what you can verify today: independent scans you can re-run, our written policies, and the audits of the providers we build on.
In place today
- Independent scans of rendro.net, graded A or A+
- Five written security policies, versioned and fingerprinted
- A public subprocessor list and a data processing agreement
- Workspace separation enforced in the database, covered by automated tests
- A vulnerability disclosure policy and security.txt
Current limitations
- SOC 2 report (not started)
- Independent penetration test (not done)
- Two-factor sign-in and single sign-on for customer accounts
Details and plans: security overview.
Independent security scans
Run by third parties against www.rendro.net. Grades as of October 29, 2026; the links re-run each scan live, so you can see today's result.
Mozilla HTTP Observatory
A+
Score 110, 12 of 12 tests passed
Browser security headers, cookies, HTTPS redirects and Content Security Policy.
securityheaders.com
A+
All six recommended headers present
The HTTP response headers that protect visitors' browsers.
Qualys SSL Labs
A
A+ and A on our host's two addresses
The HTTPS (TLS) setup: certificate, protocols and ciphers.
Security policies
Short, plain-English policies that describe what we actually do. Each download has a SHA-256 fingerprint, so you can prove the copy you keep is the one we published.
- Information Security Policyv1.0 · 2026-10-29
Who is responsible for security at Rendro, the principles we build on, and how changes are made.
ReadDownloadSHA-256 6bb6cc51273569e0f8f6194aaaec3fb9ec08ab4fd6279d7abafeb4e50d3b3b9d
- Access Control Policyv1.0 · 2026-10-29
Who can reach customer data, and how customers control access to their own workspace.
ReadDownloadSHA-256 1f232e95d459bed2086f63505e6759a4520ef29accd1e437f8645fb2e07e5a6c
- Incident Response Policyv1.0 · 2026-10-29
What we do when something goes wrong, and when customers hear about it.
ReadDownloadSHA-256 9d57f7b99399f8dfb14b876cb39e50c68a1ef9d5a7a5c681e249a8f413e43a9d
- Data Retention and Deletion Policyv1.0 · 2026-10-29
How long customer data is kept and how it is deleted.
ReadDownloadSHA-256 726d154bb5c931c32ad757cd6898be1442342785190eef23ca5158cc139d4d9d
- Vendor and Subprocessor Policyv1.0 · 2026-10-29
How we choose providers that handle customer data, and how customers hear about changes.
ReadDownloadSHA-256 c83a84ce8d0d1cc2b5be5f4aca599caa544c344ee32feb3452c299299be9cca4
How to check a fingerprint
Download the file, then compare its fingerprint with the one listed above.
Windows (PowerShell): Get-FileHash .\file.md -Algorithm SHA256
Mac or Linux: shasum -a 256 file.md
Our providers' own audits
Rendro runs on these providers. Their certifications are theirs, not Rendro's, and we don't claim otherwise; each link goes to the provider's own page so you can check.
| Provider | What it does for Rendro | What it publishes |
|---|---|---|
| Amazon Web Services | Data centre under our database (us-east-1) | SOC 1, SOC 2, SOC 3, ISO 27001 and more |
| Supabase | Database, sign-in and file storage | SOC 2 Type 2 |
| Vercel | Application hosting | SOC 2 Type 2 |
| Anthropic | AI drafting (Claude API) | See its trust portal |
| Voyage AI | Search vectors (embeddings) | SOC 2 (stated on its website) |
| Resend | SOC 2 Type II | |
| Inngest | Background jobs | SOC 2 Type II |
| Stripe | Payments | PCI DSS Level 1, SOC 2 Type II |
Documents
Report a vulnerability
Email security@rendro.net. Read our vulnerability disclosure policy for what's in scope and our promise to people who report in good faith. Our contact details are also published in the standard security.txt file.