Security that is built in,
not bolted on.
Rivora handles events from thousands of products. Here is how we protect that data, and how you stay in control of it.
SOC 2 Type II
Audited annually by an independent firm.
ISO 27001
Certified information security management.
GDPR
EU data processing agreement and SCCs.
CCPA
Service provider terms for California.
Data protection
Your data, under your control
Defaults that protect personal data, and controls that let you go further.
Encryption everywhere
TLS 1.2+ in transit and AES-256 at rest, with keys managed in a hardware-backed KMS and rotated automatically.
Data residency
Choose US or EU storage per workspace. Event data never leaves the region you pick.
Redaction in your pipeline
Hash, tokenise or drop personal data in transforms, before it reaches any destination.
Your own cloud
Enterprise customers can run the data plane in their own cloud account, inside their network boundary.
SSO, SCIM and roles
SAML or OIDC sign-on, automatic provisioning and least-privilege roles for every workspace.
Audit logs
Every change to pipelines, keys and members is logged and can be streamed to your SIEM.
Practices
How we run Rivora
Infrastructure
- Isolated production accounts with no shared credentials
- Infrastructure as code, reviewed like application code
- Multi-zone deployments with automatic failover
- Daily encrypted backups tested by restore every week
Application
- Mandatory code review and signed commits
- Dependency and container scanning on every build
- Annual third-party penetration tests
- Public bug bounty for responsible disclosure
People
- Background checks for all employees
- Security training on hire and every year
- Hardware keys required for production access
- Access reviewed every quarter
Responsible disclosure
Found something?
We welcome reports from security researchers. If you believe you have found a vulnerability, email security@rivora.example.com with steps to reproduce. Please give us reasonable time to fix it before sharing it publicly.
- We acknowledge reports within one business day.
- We will not take legal action against good-faith research that respects user privacy.
- Eligible findings are rewarded through our bug bounty.
Do not access or modify data that is not yours, run denial-of-service tests or use social engineering against our staff.
Bring every event into one place.
Free up to a million events a month. Upgrade when you outgrow it, or talk to us about volume, compliance and running Rivora in your own cloud.
Need volume pricing or a security review?
- US and EU data regions
- SSO on Enterprise
- Rewinds are always free