# Information Security Policy

Rendro (www.rendro.net). Version 1.0, effective 2026-10-29. Owner: Franklin Lupichuk, Founder.

Who is responsible for security at Rendro, the principles we build on, and how changes are made.

## Scope and ownership

- This policy covers the Rendro application, the customer data it stores, and the accounts and providers used to run it.
- The founder (Franklin Lupichuk, Founder) owns information security and approves this policy and every change to it.
- We review this policy at least once a year and whenever the system or our providers change in a way that affects it.

## Principles

- We run no servers of our own. Rendro is built on managed providers that maintain their own security programmes; they are listed at www.rendro.net/subprocessors.
- We collect and send only the data each step needs.
- Customer data is encrypted in transit (HTTPS with HSTS) and at rest (by our database and storage provider).
- Customer data is separated by workspace inside the database with row-level security, and automated tests check that one workspace can't read another's data or files.
- Uploaded documents and questionnaires are treated as untrusted data.

## Secrets

- Keys and passwords live in encrypted environment settings, never in source code.
- The database's administrative key is used only in server code.

## Change management

- Source code is private and kept in version control, so every change is recorded.
- Automated checks (type check, lint, tests and a production build) are part of how changes are made.
- An automated dependency audit runs in the build pipeline and fails the build on high-severity advisories.

## Logging

- Sensitive actions in each workspace (invitations, role changes, uploads, deletions, exports) are recorded in an audit log.
- Error and product analytics tools receive IDs and counts, never document or answer text.

## Current limitations

- Rendro has no SOC 2 report or ISO 27001 certification and has not had an independent penetration test. Our status is kept up to date at www.rendro.net/security.

Published at https://www.rendro.net/trust/policies/information-security