Security
A runtime that records every decision has to get security right first.
SOC 2 Type II, ISO 27001, HIPAA and GDPR. What follows is what we tell the security teams who review us, in the same words.
Four pillars
How we keep the blast radius small.
Keys
Root CA
Offline cold-storage, two-person control, quarterly rotation (Raidu build signing key)
Record protection
Tamper-evident records; encryption keys stay in your own cloud account
Data
At rest
AES-256-GCM with per-tenant data keys
In transit
TLS 1.3 only, HSTS preloaded, cert transparency monitored
Tenant isolation
Each install is single-tenant, in your own cloud account
Residency
Your data stays in the region of your own cloud account
Outbound calls
One daily RFC 3161 timestamp request, carrying a hash of the record, not its content
Access
Employee access
Zero standing access to customer data; JIT via PAM, every request recorded
Admin MFA
Hardware security keys (FIDO2), phishing-resistant, mandatory
Customer SSO
SAML 2.0 and OIDC, SCIM 2.0 provisioning, enforced session policies
Least privilege
Periodic access reviews by management, checked in the SOC 2 Type II audit
Infrastructure
Deployment
Your own cloud account: AWS, Google Cloud or Kubernetes
Network
Private VPCs, no public egress from processing paths, WAF on control plane
Hardening
CIS benchmarks, image signing, runtime policy on all workloads
Backups
Raidu infrastructure: encrypted, cross-region, restore tested weekly, WORM retention
Program
Continuous, not annual.
SOC 2 Type II
Report available
Independent auditor
Security, Availability and Confidentiality criteria, Raidu platform; report shared under NDA
ISO/IEC 27001:2022
Certified
INTERCERT
ISMS for the Tower platform and supporting cloud infrastructure; issued 1 Sep 2026; surveillance valid to 31 Aug 2027
HIPAA
Compliant
Independent assessment
Report dated 4 Sep 2026
GDPR
Compliant
Independent assessment
Report dated 4 Sep 2026; DPA and subprocessor list public
Reporting a vulnerability
We want to hear from you.
Good-faith security research is welcome and encouraged. We commit to acknowledging reports within one business day, triaging within three, and, where appropriate, publishing a public advisory with credit to the reporter.
Email
security@raidu.com
Preferred; we reply within 1 business day
Response SLA
≤ 1 business day
Triage ≤ 3 business days
InfoSec review? Request the full pack.
SOC 2 Type II report, ISO/IEC 27001:2022 certificate, and the HIPAA and GDPR assessment reports. Available under NDA on request.