Security

This page describes the current security controls in place on the RHAWK platform. It is maintained by RHAWK and is not a certification or independent audit. We're happy to walk through anything below with your security team - email security@ratehawk.app.

• Application runs on Cloudflare's global edge network with automatic DDoS protection.
• Managed Postgres database with automated daily backups and point-in-time recovery.
• All infrastructure is US-region hosted.

• All traffic to and from RHAWK is served over TLS 1.2+ with modern cipher suites.
• Data at rest in our primary database and object storage is encrypted using AES-256.
• Application secrets are stored in a managed secrets vault, never in source control.

• Passwords are hashed with bcrypt / argon2. We never store plaintext passwords.
• Google sign-in supported. SSO available on request for higher plans.
• Internal team access to production is limited to named engineers on the on-call roster and requires MFA.
• Every table uses row-level security so one customer's data can never be returned in another customer's query.

• Modern web stack with automatic dependency updates and SCA scanning on every build.
• Server-side input validation and output encoding to prevent XSS/SQLi.
• CSRF tokens on state-changing endpoints and strict CORS policies on the API.
• Rate limiting and abuse detection on all public endpoints.

• Real-time error monitoring and performance metrics across the app.
• Audit logs for admin actions and access to sensitive resources.
• Documented incident-response plan with a target 24-hour customer notification window for confirmed breaches.

We use a small set of sub-processors to deliver the Services. Current list: Cloudflare, Supabase, Stripe, Resend, Firecrawl, Google (Gemini), OpenAI. See the Privacy Policy for what each one processes. We update this list before adding new sub-processors that handle personal data.

RHAWK secures the platform. You are responsible for choosing strong passwords, protecting your login credentials, granting internal team members the right level of access, and following your own directory-platform terms when publishing replies.

Please report suspected vulnerabilities to security@ratehawk.app. We ask that you avoid public disclosure while we investigate and confirm receipt within 2 business days.