SECURITY & TRUST

Built for operators who take security seriously.

Rixora handles brand assets, customer conversations, and revenue data for thousands of businesses. Here's exactly how we keep it safe.

Security pillars

TLS 1.3 in transit. AES-256 at rest. Customer secrets sealed in a managed key vault — never in plaintext.

Granular roles (user, admin, super-admin) with row-level security on every sensitive table. SSO/SAML on Enterprise.

Postgres RLS enforces strict workspace isolation. Storage paths are tenant-scoped — your data never leaks across customers.

Backed by Supabase + Cloudflare. Multi-region failover, automated backups, 99.9% uptime target.

Sentry error tracking, audit logs on all admin actions, and PostHog session monitoring on private routes only.

Secrets injected via Supabase Cloud — rotated regularly, never committed to source, never visible in logs.

We're transparent about what's in place today and what's still in progress.

GDPR-ready

Data export + deletion endpoints, DPA available, EU data routing on request.

CCPA-ready

Right-to-know and right-to-delete supported via your dashboard.

SOC 2 Type II

In progress — independent audit underway. Type I report and security questionnaire available under NDA.

PCI-aware

We never store raw card data. Stripe + Paddle handle all payments under their PCI DSS Level 1 attestations.

Internal security review every quarter. Pen test annually with a third-party firm.

Responsible disclosure welcome. Email security@rixoraagency.com — acknowledged within 24 hours.

Every vendor that touches customer data is listed in our public subprocessor registry.

All employees and contractors with production access are background-checked and trained on data handling.

Reporting a vulnerability? We acknowledge within 24 hours.

ENTERPRISE-GRADE TRUST

From day-one founders to 32-brand operators — Rixora secures your data the same way.