Cybersecurity Statement and Disclaimer

How we protect the service

• Encryption in transit. Every connection uses HTTPS, with certificates; plain HTTP is redirected.
• Encryption at rest. The database, dashboards and backups sit on an encrypted volume on the server.
• Passwords. Never stored, only one-way hashes. New accounts and invites are confirmed by one-time codes sent to the email address, with limited attempts and short lifetimes.
• Two-factor sign-in. A company can require a code after the password, for everyone, for a group or for one person, and anyone can turn it on for themselves by setting up an authenticator app. Codes come from the app or by email; repeated wrong codes pause sign-in to the account and tell its owner. Authenticator keys are stored encrypted, with a key kept apart from the database and its backups. Changing an account's email address takes a code sent to the new address.
• Sessions. Kept on the server, with protection against cross-site request forgery. The company you work in is fixed when you sign in, never taken from what the browser sends.
• Access control. Every request is checked on the server against the functions granted to you or your groups. Each company's data is kept separate.
• Integrity. Two people saving the same record cannot silently overwrite each other; posted documents cannot be changed; every change is recorded in a history of who changed what and when.
• Intrusion prevention. Traffic is analysed by an intrusion prevention system (IPS), and addresses that attack the service are blocked at the firewall. Only the ports the service needs are open.
• Maintenance. The software and the images it runs in are rebuilt with current security patches, and supporting images are checked regularly.
• Backups. Nightly, kept for 14 days, encrypted.

What we do not claim

RPMCODE is not certified under ISO/IEC 27001, SOC 2, PCI DSS or any similar scheme. Sign-in is by email address and password, followed by a code wherever two-factor sign-in is turned on; where it is not, the password alone guards the account, so choose a strong password you use nowhere else. Codes can be passed on by a convincing fake page within their short lifetime: only ever type them into RPMCODE itself.

What you must do

• Use a strong, unique password for each account, and never share accounts.
• Protect the email account your sign-in uses: codes and password resets go there.
• Turn on two-factor sign-in, for your company or at least for the people who administer it.
• Give each person only the access they need, and remove people who leave straight away.
• Keep your devices, browsers and operating systems up to date and free of malware.
• Be wary of phishing. RPMCODE will never ask for your password, codes or card details.
• Export and keep your own copies of important data.
• Tell us at once about anything suspicious.

Disclaimer

No system connected to the internet can be made completely secure, and we cannot guarantee that RPM will never be breached.

To the extent the law allows, RPMCODE is not liable for unauthorised access, loss or damage caused by things outside our reasonable control — including compromised passwords or email accounts, your devices or networks, the actions of people you gave access to, or attacks we could not reasonably have prevented. Our liability is otherwise limited as the Terms and Conditions set out.

If something goes wrong

If a security incident affects your information, we will contain it, investigate it, tell affected customers without undue delay, and notify regulators and individuals where the law requires — for example under the GDPR, POPIA section 22, Australia's Notifiable Data Breaches scheme, New Zealand's Privacy Act 2020, and US state breach laws.

Found a vulnerability?

Please tell us privately: see Responsible Disclosure.