# How does Reynforce keep customer data safe? **Each customer has a separate deployment in London, encrypted at rest by Fly.io, with nightly encrypted backups and a weekly test that a backup restores.** It runs on established suppliers who publish their own security audits, and the table below says which audit each one holds, in their words, with a link. **Reynforce itself holds no certification**: no SOC 2, no ISO 27001, no Cyber Essentials. We would rather say that plainly than let a supplier's badge stand in for one of ours. [What we hold, where it lives, and who can reach it](trust.html) is the detailed version, written for a security reviewer. ## How your data is protected | | | |---|---| | **one deployment per customer** | your facts, rules, people and record are on your own application and your own storage, in London. Another customer's credential is refused at your door | | **encrypted at rest** | Fly.io encrypts every volume at block level with per-customer keys. That is their encryption, with their keys, and we do not claim it as ours | | **encrypted by us** | credentials for systems you connect, and **every backup**, encrypted with our own keys before anything leaves your deployment | | **backed up every night** | an encrypted copy of your store goes to Cloudflare every night, and **every week a backup is restored** onto a fresh machine and its contents counted against the original | | **a backup never holds a credential** | the store of connection credentials is left out of every backup on purpose, so a restore means reconnecting rather than a copy of a live password sitting in storage | | **agent keys are never stored** | a key is shown once when it is made and kept only as a fingerprint, so nobody can read it back, us included | | **agents cannot change your facts** | an agent's key lets it read your facts and ask permission. Only a signed-in person can add, accept or change one | | **everything is recorded** | every check, every answer and every change a person makes is written to a record that is only ever added to | | **sign-in through WorkOS** | your people sign in through WorkOS, and only people in your own organisation are let into your workspace | | **card details never reach us** | payment runs on Stripe's hosted checkout | ## The suppliers it runs on Each row is what that supplier's own page says, read on **27 October 2026**. A supplier's certification covers the supplier, not Reynforce. | supplier | what it does for us | what they publish | where it is stated | |---|---|---|---| | **Fly.io** | runs each customer's deployment and storage | a **SOC 2 Type 2** audit. Not ISO 27001 for Fly itself; their data centres are | [security questionnaire](https://fly.io/legal/security-questionnaire/), [compliance](https://fly.io/compliance/) | | **Cloudflare** | the website, and storage for encrypted backups | **ISO 27001**, 27018 and 27701, and **SOC 2 Type II** with R2, the storage we use, in scope | [ISO](https://www.cloudflare.com/trust-hub/compliance-resources/iso-certifications/), [SOC 2](https://www.cloudflare.com/trust-hub/compliance-resources/soc-2/) | | **WorkOS** | sign-in, and the directory roles are read from | **SOC 2 Type 2** | [security](https://workos.com/security) | | **Stripe** | payments, once they are live | **PCI DSS Level 1** as a service provider, and SOC 1 and SOC 2 Type II reports each year | [security](https://docs.stripe.com/security) | | **Resend** | sending email | **SOC 2 Type II**. Their stored data is in the **United States** | [security](https://resend.com/security), [SOC 2](https://resend.com/security/soc-2) | | **Anthropic** | the AI model that suggests facts when you set up an agent, while that reader is switched on | **SOC 2** Type I and II, **ISO 27001** and **ISO 42001**. Their stored data is in the **United States** | [certifications](https://privacy.claude.com/en/articles/10015870-what-certifications-has-anthropic-obtained) | | **GitHub** | holds the code, and runs our deploys | SOC 1 and SOC 2 Type 2 and **ISO 27001** reports for its enterprise service | [compliance reports](https://docs.github.com/en/enterprise-cloud@latest/admin/overview/accessing-compliance-reports-for-your-enterprise) | **Where data leaves the UK, it is in that row.** Two more are worth knowing: Fly keeps **its own copies of a volume, and its control-plane records, in the United States** whatever region an app runs in, which their questionnaire states. And the region our Cloudflare backups are stored in is **not yet confirmed**. The [privacy notice](privacy.html) carries the same table, and is the one to rely on. ## What we have not done yet | | | |---|---| | **an independent penetration test** | not yet. An internal review of the code was run on 27 October 2026; it was not independent, and the problems it found are being fixed | | **Cyber Essentials** | planned, not yet booked | | **SOC 2 or ISO 27001 of our own** | not held and not in progress | | **a second person with emergency access** | not yet. Today one person holds every credential | Anything a security questionnaire asks that this page does not answer, email and you will get a straight answer, including when the answer is *not yet*.