Information Security Policy

Who is responsible for security at Rendro, the principles we build on, and how changes are made.

Version 1.0 · effective 2026-10-29 · owner Franklin Lupichuk, Founder

Scope and ownership

This policy covers the Rendro application, the customer data it stores, and the accounts and providers used to run it.
The founder (Franklin Lupichuk, Founder) owns information security and approves this policy and every change to it.
We review this policy at least once a year and whenever the system or our providers change in a way that affects it.

We run no servers of our own. Rendro is built on managed providers that maintain their own security programmes; they are listed at www.rendro.net/subprocessors.
We collect and send only the data each step needs.
Customer data is encrypted in transit (HTTPS with HSTS) and at rest (by our database and storage provider).
Customer data is separated by workspace inside the database with row-level security, and automated tests check that one workspace can't read another's data or files.
Uploaded documents and questionnaires are treated as untrusted data.

Keys and passwords live in encrypted environment settings, never in source code.
The database's administrative key is used only in server code.

Source code is private and kept in version control, so every change is recorded.
Automated checks (type check, lint, tests and a production build) are part of how changes are made.
An automated dependency audit runs in the build pipeline and fails the build on high-severity advisories.

Sensitive actions in each workspace (invitations, role changes, uploads, deletions, exports) are recorded in an audit log.
Error and product analytics tools receive IDs and counts, never document or answer text.

Rendro has no SOC 2 report or ISO 27001 certification and has not had an independent penetration test. Our status is kept up to date at www.rendro.net/security.