Rulisto Trust Center

Every code commit is scanned by GitHub CodeQL for advanced injection vulnerabilities (SAST) while OWASP ZAP performs automated nightly DAST scans.

We utilize Trivy for container and infrastructure file scanning alongside TruffleHog for deep entropy secret scanning, API keys are stored as non-reversible SHA-256 hashes.

GDPR & CCPA Portability

Rulisto complies with GDPR Article 20, granting you complete ownership of your data via a 1-click JSON export mechanism spanning all assessments, models, and empirical data.

Inherited Infrastructure SOC 2 & ISO 27001

Rulisto itself does not currently hold a SOC 2 Type II certification. Instead, under the Shared Responsibility Model, we inherit infrastructure-level certifications: our data layer and hosting infrastructure are built entirely upon SOC 2 Type II and ISO/IEC 27001 certified providers (Vercel & Supabase/AWS).

CSA STAR (Self-Assessment)

Rulisto aligns with the Cloud Security Alliance (CSA) best practices. We utilize the Consensus Assessments Initiative Questionnaire (CAIQ) framework to transparently document our cloud security controls.

Automated Vulnerability Scanning

Our CI/CD pipelines enforce strict security gates on every deployment:

• SAST: GitHub CodeQL scans source code for injection flaws and logic vulnerabilities.
• DAST: OWASP ZAP performs nightly scans of the staging environment.
• Supply Chain: Continuous audits prevent CVEs in third-party dependencies.

Data Residency & Encryption

All metadata is hosted in the US (AWS us-east-1). Data is strictly encrypted at rest using AES-256 and protected in transit utilizing TLS 1.3 cryptography.