Rappel

Security

Your financial data, protected at every layer

Rappel handles sensitive business financial data, and we treat that responsibility as the foundation of the product — not an afterthought. Here is exactly what we do to protect it.

Type-safe

Memory-safe backend

Our backend services are written in memory-safe languages, eliminating whole classes of vulnerabilities by construction — buffer overflows and use-after-free — with strict type-checking and dependency vulnerability scanning gating every merge.

GDPR

Data residency you control

Data is stored in the EU/US by default, and enterprise customers can choose their database region (US, UK, EU, AU, IN, and more). Cross-region transfers are always encrypted in transit. Your data is never sold or shared with third parties.

Encrypted at rest

Credential encryption

Third-party integration credentials — API keys, OAuth tokens, access tokens — are encrypted at rest with authenticated encryption (Fernet: AES-128-CBC + HMAC-SHA256) before they ever touch the database. Never stored or logged in plaintext.

TLS 1.2/1.3

Encryption in transit

Every connection — browser to app, app to API, API to database and cache — uses TLS 1.2/1.3. HTTPS everywhere, with HTTP traffic redirected.

Edge

Hardened edge

The website and app are served from a global edge network with DDoS mitigation and CDN caching. Bot protection covers all public forms and rate limiting guards every endpoint.

24/7

Monitoring & observability

Errors are tracked with automated alerting, uptime is independently monitored with a public status page, and structured logging gives us full observability into the platform.

In detail

Our security practices

Infrastructure security

Website and app hosted on a global edge network — CDN and DDoS mitigation by default, with dedicated DNS and bot protection.
Backend API server and background workers run on managed cloud infrastructure (EU region; the provider in use may vary over time).
Database: managed, access-controlled and network-restricted, EU/US by default (enterprise customers can choose a region: US, UK, EU, AU, IN, and more).
File storage and caching use encrypted, access-controlled managed services.
No database or cache is exposed directly to the public internet.

Data encryption

At rest: integration credentials (OAuth tokens, API keys) are encrypted with authenticated encryption (Fernet) before storage.
Business data (orders, transactions, journals) lives in an access-controlled managed database protected by infrastructure-level security.
In transit: TLS 1.2/1.3 on every connection — external and service-to-service.

Access control & authentication

API authentication uses encrypted tokens; sessions are validated on every request.
Bot protection on all public forms.
Rate limiting on all endpoints to block brute-force and abuse.
Backend services are written in memory-safe languages, eliminating memory-corruption vulnerability classes by construction.

Third-party integration security

Integrations — Shopify (incl. Shopify POS), WooCommerce, Square, Stripe (incl. Stripe Connect), PayPal, QuickBooks Online, Xero, Meta Ads, and Google Ads — connect only after your explicit authorization.
OAuth tokens and API keys are encrypted (Fernet) immediately on receipt and never written to logs.
We request the minimum scopes each platform allows for the sync work you configure.
Disconnecting an integration revokes our access and deletes the stored credentials.

Operator access to data

Rappel is run by a single operator; no broad employee access exists.
Production access is limited to operating, supporting, and maintaining the service — never for any other purpose.
Customer business data is accessed for support only when needed to resolve your issue.
Your data is never sold, rented, or shared with third parties beyond the sub-processors that run the service.

Monitoring & incident response

Automated error monitoring with alerting on anomalies.
Independent uptime monitoring and a public status page.
Structured logging and observability across the API and workers.
Documented incident response: contain, assess impact, remediate, notify.

Incident response

72-hour breach notification

In line with GDPR requirements, if we confirm a data breach affecting your personal data, we will notify affected users within 72 hours of becoming aware of it — with what happened, what data was involved, and what we are doing about it. Where required, we also notify the relevant supervisory authorities, including the Data Protection Board of India under the DPDP Act 2023.

Read our full Privacy Policy →

Key facts

Data residencyEU/US
Credential encryptionEncrypted at rest
Encryption in transitTLS 1.2/1.3
Bot protectionEnabled on all public forms
Error monitoringAutomated, 24/7
Breach notificationWithin 72 hours
Last updatedJune 12, 2026

A note on third-party platforms

We secure everything on our side — but the security of the third-party platforms you connect (your store, payment processor, or accounting software) is managed by those providers under their own security programs. We are not responsible for incidents originating on platforms outside our control. We recommend enabling two-factor authentication on every connected platform.

Responsible disclosure

Found a vulnerability? Please report it to us privately before disclosing it publicly, with enough detail to reproduce the issue. We will acknowledge your report within 48 hours, keep you informed as we fix it, and aim to remediate critical issues within 7 days. We will never take legal action against good-faith security research.

security@rappelhq.com →

Security questions & DPA requests

Questions about our security practices, or need a signed Data Processing Agreement for your compliance requirements? Get in touch — we respond within 2 business days.

privacy@rappelhq.com →