How does Reynforce keep customer data safe?
Each customer has a separate deployment in London, encrypted at rest by Fly.io, with nightly encrypted backups and a weekly test that a backup restores. It runs on established suppliers who publish their own security audits, and the table below says which audit each one holds, in their words, with a link.
Reynforce itself holds no certification: no SOC 2, no ISO 27001, no Cyber Essentials. We would rather say that plainly than let a supplier's badge stand in for one of ours. What we hold, where it lives, and who can reach it is the detailed version, written for a security reviewer.
How your data is protected
| one deployment per customer | your facts, rules, people and record are on your own application and your own storage, in London. Another customer's credential is refused at your door |
| encrypted at rest | Fly.io encrypts every volume at block level with per-customer keys. That is their encryption, with their keys, and we do not claim it as ours |
| encrypted by us | credentials for systems you connect, and every backup, encrypted with our own keys before anything leaves your deployment |
| backed up every night | an encrypted copy of your store goes to Cloudflare every night, and every week a backup is restored onto a fresh machine and its contents counted against the original |
| a backup never holds a credential | the store of connection credentials is left out of every backup on purpose, so a restore means reconnecting rather than a copy of a live password sitting in storage |
| agent keys are never stored | a key is shown once when it is made and kept only as a fingerprint, so nobody can read it back, us included |
| agents cannot change your facts | an agent's key lets it read your facts and ask permission. Only a signed-in person can add, accept or change one |
| everything is recorded | every check, every answer and every change a person makes is written to a record that is only ever added to |
| sign-in through WorkOS | your people sign in through WorkOS, and only people in your own organisation are let into your workspace |
| card details never reach us | payment runs on Stripe's hosted checkout |
The suppliers it runs on
Each row is what that supplier's own page says, read on 27 October 2026. A supplier's certification covers the supplier, not Reynforce.
| supplier | what it does for us | what they publish | where it is stated |
| Fly.io | runs each customer's deployment and storage | a SOC 2 Type 2 audit. Not ISO 27001 for Fly itself; their data centres are | security questionnaire, compliance |
| Cloudflare | the website, and storage for encrypted backups | ISO 27001, 27018 and 27701, and SOC 2 Type II with R2, the storage we use, in scope | ISO, SOC 2 |
| WorkOS | sign-in, and the directory roles are read from | SOC 2 Type 2 | security |
| Stripe | payments, once they are live | PCI DSS Level 1 as a service provider, and SOC 1 and SOC 2 Type II reports each year | security |
| Resend | sending email | SOC 2 Type II. Their stored data is in the United States | security, SOC 2 |
| Anthropic | the AI model that suggests facts when you set up an agent, while that reader is switched on | SOC 2 Type I and II, ISO 27001 and ISO 42001. Their stored data is in the United States | certifications |
| GitHub | holds the code, and runs our deploys | SOC 1 and SOC 2 Type 2 and ISO 27001 reports for its enterprise service | compliance reports |
Where data leaves the UK, it is in that row. Two more are worth knowing: Fly keeps its own copies of a volume, and its control-plane records, in the United States whatever region an app runs in, which their questionnaire states. And the region our Cloudflare backups are stored in is not yet confirmed. The privacy notice carries the same table, and is the one to rely on.
What we have not done yet
| an independent penetration test | not yet. An internal review of the code was run on 27 October 2026; it was not independent, and the problems it found are being fixed |
| Cyber Essentials | planned, not yet booked |
| SOC 2 or ISO 27001 of our own | not held and not in progress |
| a second person with emergency access | not yet. Today one person holds every credential |
Anything a security questionnaire asks that this page does not answer, email [email protected] and you will get a straight answer, including when the answer is not yet.