This Privacy Policy explains how RootSystems ("we," "us," or "our") collects, uses, and protects personal data when you visit rootsystems.app or use our products: Offboarding Proof, Vendor Risk, HIPAA, Standards Readiness, AI Agent Trust (Agent Certificates, the Action Ledger and Named Sign-off, and Contract & Insurance Gap), and PQC Forge (together, the "Services"). One policy covers all of them.
RootSystems is an independent software business owned and operated by an individual in Tennessee, United States. Contact: hello@rootsystems.app.
1. Our Role: Controller and Processor
- Account, billing, and website data. For the information we collect to run your account and our website, we decide how it is used and act as the controller.
- Data you put into the Services. For the information your organization adds to a product (for example, employee lists in Offboarding Proof, vendor details in Vendor Risk, or answers in an assessment), your organization is the controller and we act as its processor. We handle that data only to provide the Services, under our Data Processing Agreement.
2. Information We Collect
Account information: your name, work email address, organization name, and password (stored only as a secure hash, never in plain text).
Content you add to the Services: questionnaire responses, assessment results, risk registers, vendor records, employee and contractor records, AI-agent profiles and certificates, and the reports generated from them.
Integration data: when you connect a system (such as Google Workspace, Microsoft 365, Slack, GitHub, or Okta in Offboarding Proof), we read only what a check needs, such as whether a person's account is still active. We do not use this access for anything else.
Usage and security logs: login times, actions taken in the product, and technical data such as IP address and browser type, kept for security and troubleshooting.
Website contact form: your name, email address, and message. Stored messages are deleted automatically after 90 days.
Payment information: payments are handled by Dodo Payments, which acts as merchant of record. We never receive or store your full card details.
We do not ask for, and the Services are not designed to hold, special categories of personal data (such as health, biometric, or religious data). The HIPAA Compliance tool records your organization's safeguards and risks; do not enter patients' health information into it.
3. Why We Use It (Legal Bases)
For people covered by the EU or UK General Data Protection Regulation (GDPR), we rely on these legal bases:
| Purpose | Legal basis |
|---|---|
| Creating your account and providing the Services you signed up for | Performance of a contract |
| Billing, tax, and accounting records | Legal obligation |
| Keeping the Services secure, preventing abuse, and fixing problems | Legitimate interests |
| Replying to messages sent through our contact form | Legitimate interests |
| Optional product news, where we ask you first | Consent (you can withdraw it at any time) |
We do not sell personal data, use it for advertising, or make decisions with legal or similarly significant effects about individuals by automated means. Scores and findings in our products are information for your organization to review.
4. Who We Share It With (Sub-processors)
We use a small number of service providers, each bound by contract to protect your data and use it only to provide their service to us:
| Provider | What they do for us | Location |
|---|---|---|
| Render | Hosts our applications and one database | United States (Oregon) |
| Neon | Hosts our databases (on Amazon Web Services) | United States (US West) |
| Vercel | Hosts the rootsystems.app website | United States / global edge network |
| Dodo Payments | Checkout, subscriptions, and tax as merchant of record | See Dodo Payments' own privacy policy |
| Support email (Gmail) and the fonts used on our website | United States | |
| Cloudflare | Routes email sent to hello@rootsystems.app to our support inbox | United States / global network |
We may also disclose data to legal authorities when required by a valid legal process, or to a successor in a merger or sale of the business, with notice to you where the law requires. We will update this list before adding a new provider that handles personal data.
5. International Transfers
Our Services are hosted in the United States. If you use them from the European Economic Area, the United Kingdom, or Switzerland, your data is transferred to the United States. We protect those transfers with the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, which are incorporated into our Data Processing Agreement.
6. How We Protect It
- Sensitive fields are encrypted at rest with AES-256, and all connections use TLS.
- Passwords are stored only as salted hashes.
- Reports and records are fingerprinted with SHA-256 and SHA-512 and signed with ML-DSA-65 (NIST FIPS 204), so tampering is detectable.
- Access to production systems is limited to the owner of RootSystems.
No system is perfectly secure. If a personal data breach affects your data, we will notify you without undue delay.
7. How Long We Keep It
- Account data and content: for as long as your account is active. After you close your account or ask us to delete your data, we delete it within 30 days, except where the law requires us to keep it (for example, billing records) or where your organization chose to keep a signed report as an audit record.
- Contact form messages: 90 days.
- Security and activity logs: as long as needed to keep the Services secure and to support your organization's audit trail.
8. Your Rights
Depending on where you live, you have the right to:
- access the personal data we hold about you and receive a copy;
- correct inaccurate data;
- have your data deleted;
- restrict or object to certain processing;
- receive your data in a portable format;
- withdraw consent at any time, where we rely on consent.
To use these rights, email hello@rootsystems.app. We will reply within one month. If your data was added to a product by your employer or another organization, we will pass your request to that organization, which controls it, and help it respond.
If you are in the EU or UK, you may also complain to your local data protection authority (in the UK, the Information Commissioner's Office). We would appreciate the chance to resolve your concern first.
United States residents: we do not sell or share personal information for cross-context behavioral advertising.
9. Cookies
We use only essential cookies, to keep you signed in and to protect forms against forgery. We do not use advertising or analytics trackers. When you visit rootsystems.app, your browser loads fonts from Google Fonts, which receives your IP address to deliver them.
10. Children
The Services are for businesses and are not directed at anyone under 18. We do not knowingly collect personal data from children.
11. Changes to This Policy
If we make material changes, we will give reasonable notice (by email or in the product) before they take effect. The date at the top shows the latest version.
12. Contact Us
Questions about this policy or your data: hello@rootsystems.app.