Security

Disclaimer:
This FAQ provides general information about Rask AI’s Enterprise features and services. It does not form part of any agreement or establish standard contractual terms or commitments. Features, service levels, data processing and retention arrangements and other service commitments are governed by the applicable Terms of Service, Order Form, Data Processing Agreement and any other agreement between the parties. If this FAQ differs from those documents, those documents control. Please contact our team to confirm any specific requirements in writing.

Is Rask SOC 2 certified?

Yes. Rask is SOC 2 Type II certified and GDPR compliant.

Security documentation is available through our Trust Center.

How is our data encrypted?

In transit: all data sent to users and between external services is encrypted with HTTPS (TLSv1.*). At rest: stored files use Amazon S3 server-side encryption (SSE-S3), where each item is encrypted with a unique key.

How is access to our data controlled?

Customer content is logically separated by account.
Our application uses authentication and account-based authorization to restrict access to the relevant customer’s data. Time-limited signed URLs provide temporary access to specific files for uploads and downloads.
Employee access is limited by role and business need, with MFA protecting employee access to AWS.

What network security measures are in place?

External access to our servers is is restricted using AWS VPC security groups, load balancers, and AWS-managed firewalls. Administrative access is limited to authorized personnel over approved encrypted connections. Customer-facing endpoints use HTTPS.

How do you handle backups and recovery?

We maintain documented backup and disaster recovery procedures.
Our policies require regular backups of in-scope systems, encryption of confidential backup data, and storage separate from production data.
The disaster recovery plan requires annual testing, including backup restoration.
Any contractual recovery commitments are set out in the applicable agreement.

Do you run penetration tests?

Yes. We perform regular third-party penetration testing as part of our ongoing SOC 2 compliance program.

Do you have a formal security program, employee training and endpoint protection?

Yes. We maintain a formal information security program with documented policies, clearly defined security roles and responsibilities, and executive oversight.
All employees complete security-awareness training during onboarding and annually thereafter, with additional training for personnel who have privileged access to production systems.
Company devices are centrally managed and protected with full-disk encryption, anti-malware software, and automatic security updates.

How will you notify us of a security incident?

We maintain a documented incident response plan that defines how we detect, investigate, contain, and resolve security incidents. If we confirm a security incident affecting your data, we will notify your designated contacts without undue delay, in accordance with applicable laws and your agreement with us.
Notifications include the nature of the incident, the data affected, the steps we're taking in response, and any recommended actions on your side.
Enterprise agreements can specify notification timelines, contact channels, and ongoing update requirements.

How do you handle payment information?

All payments are processed by Stripe, a PCI DSS Level 1 certified payment provider. Card details are entered directly into Stripe's secure payment forms and are never transmitted to or stored on our servers.
All payment information is stored securely by Stripe.

What uptime and support commitments do you offer?

Enterprise customers receive a dedicated account manager, priority support, and custom service level agreements (SLAs) tailored to their uptime and response-time requirements.
Our team will work with you to define commitments that fit your needs.
To discuss SLA terms, contact your account manager or reach out to our sales team.

How do we report a security vulnerability?

If you believe you've discovered a security vulnerability, please report it to our team at support@rask.ai with "Security Vulnerability" in the subject line.
Every report is logged, reviewed by our engineering team, and tracked through to resolution.