Security
A compliance vendor should be the easiest vendor you ever review. Here is exactly how the RootSystems products treat your data.
Data minimization
Evidence files in Offboarding, Vendor Risk, HIPAA and Standards, and every file checked on /verify, are fingerprinted in memory and never written to disk or logs. AI Agent Trust keeps the contracts you upload, encrypted (AES-256-GCM), and deletes them after 30 days by default. Report files can be set to expire while their fingerprints stay, so you can still prove a report is genuine.
Connectors
A connector asks your system one question, such as "is this account disabled?", and keeps the answer and the time. It never copies your directory, mailbox or files. Checks only read. Nothing changes an account unless you switch on close-access, which is off by default. Alerts name people by employee number unless you choose to include names.
Encryption
Customer content and connector credentials are encrypted at rest with AES-256-GCM, and every product is served only over HTTPS. Passwords are never stored, only salted hashes (bcrypt).
Connectors
Connectors only read what a check needs. Offboarding Proof can also close a leaver's leftover access, but that is off by default, needs a company Admin to turn it on and extra write permissions you grant, never runs before the leaving date, and leaves a signed receipt for every action. Close-access disables or suspends the account and signs it out of active sessions and app permissions. No account, mailbox or file is deleted.
Separation
Each customer's records are scoped to their own workspace, and every request is checked against it. Signing up gives access to your workspace only, never to anyone else's.
Signatures
Every report is fingerprinted with SHA-256, signed with ML-DSA-65 (with a SHA-512 digest of the signed data), the post-quantum signature algorithm standardized in NIST FIPS 204. Every report is signed and hash-chained; check a report on the product's Reports page (how). Reports can also be checked by anyone, without an account, on each product's public /verify page: Offboarding, Vendor Risk, HIPAA, Standards and AI Agent Trust. AI agent certificates can be checked the same way: verify an agent certificate.
Payments
Dodo Payments is the merchant of record for every subscription. Invoiced work, such as a PQC Forge report, is paid against our invoice. Card numbers never touch RootSystems systems.
Our own code
Every change to our five products is scanned by the PQC Forge gate in CI, and a failing scan is flagged on the change. Sign-in forms are rate-limited and check where requests come from.
Found a problem?
Report a vulnerability
Email hello@rootsystems.app with the steps to reproduce it. Every report is read by a person. Our security.txt has the details.
Where your data is processed, and by which providers, is listed in the privacy policy and the data processing agreement.
