Security
We are asking you to connect your source code to us. This page is what we would want to read before doing that, written without the words a security page usually hides behind.
Where your data is
Everything is in AWS ap-southeast-2 (Sydney). Your code, your findings, your evidence and your backups stay in Australia. This is not a configuration option we might change — the whole deployment is there.
Governed by the Australian Privacy Principles (Privacy Act 1988). Ruah Tech Solutions is the contracting party and the data controller, and the contract is Australian.
How it is built
One tenant cannot read another, enforced by the database
Every table carrying customer data has a row-level security policy, and the application connects as a role that cannot bypass it. A query that forgets its tenant returns nothing rather than returning everything — which is the failure mode you want, and it is the database enforcing it rather than the code remembering to.
Read-only by default, and scoped to what you tick
A repository connection can read the repositories you selected and nothing else. It cannot push and cannot open a pull request until you turn fix delivery on, which is a separate decision with a separate permission.
Credentials are encrypted with a key that is not in the database
A dump of our tables is not a dump of your tokens. Keys are held in AWS KMS, rotated, and every use is logged.
Every state change is in an audit log you can read and export
Including ours. If a RuahTech engineer acts inside your workspace, that is a row with their name on it, and you can see it.
Nothing is deleted because you stopped paying
Not on downgrade, not on cancellation, not on non-payment. Export keeps working throughout. A product that holds your data hostage has stopped being a product.
What the models see, and what they decide
Model providers are sent the code needed to propose a fix and the findings needed to write a summary. Your code is not used to train anybody’s model. And the important half: a model never decides anything. It proposes; a person or a rule you wrote applies. There is no column in our database that a model’s output writes to directly.
Who else touches it
The complete list. A sub-processor list that leaves out the awkward one is the thing that ends a deal in due diligence rather than on this page.
| Who | What for | Where |
|---|---|---|
| Amazon Web Services | Hosting, storage, encryption keys and email delivery. | Sydney (ap-southeast-2) |
| Anthropic | The models behind fix synthesis, triage suggestions and risk stories. | United States |
| Stripe | Payments and tax invoicing. | United States and Australia |
Reporting something to us
Email security@ruah.ai. We will acknowledge within two business days and tell you what we are doing about it. We will not threaten you, we will not ask you to sign anything before we will read it, and we will credit you if you want to be credited.
Testing against your own workspace is welcome. Testing that affects another customer, degrades the service, or reaches data that is not yours is not — and we will say so rather than pretend that boundary does not exist.
What we do not claim
- We hold no ISO 27001 or SOC 2 certification. When we do, it will be named here with its scope and its date, and not before.
- A Proof of Fix says one finding was fixed and re-checked on one date. It is not a certification and our documents say so on their face.
- Our Essential Eight coverage is partial, and the page about it says which three strategies we cannot evidence at all.