Security & trust
The safest data to hold is the data we never see.
Most security pages explain how a vendor protects the copy of your data they are holding. We would rather explain why there is no copy — and then be specific about the parts where that is not the whole story.
- Deployment
- Your infrastructure
- Product telemetry
- None
- Secrets at rest
- Encrypted, always
- Disclosure
- security@revoluzen.io
What we hold
The short version: your pipeline data, credentials and query results stay on your infrastructure. We hold what you send us in an email, and that is close to the whole list.
| Data | Where it lives | Do we have access? |
|---|---|---|
| Your source data and pipeline outputs | Your infrastructure | No |
| Connection credentials | Your instance, encrypted at rest | No |
| Run history and logs | Your instance | No |
| Dashboards, models and reports | Your instance | No |
| Product usage / telemetry | Not collected | No — there is nothing to access |
| Enquiries you send us | Our email | Yes — you wrote to us |
| Support material you share with us | Shared deliberately, case by case | Yes, for as long as the case needs |
Defaults that fail closed
Security properties that are on by default and have to be deliberately relaxed, rather than features you have to remember to switch on.
Loopback by default
A fresh install binds 127.0.0.1:8001 and is unreachable from the network. Exposing it to the LAN is an explicit environment-variable opt-in, not a default.
Secrets encrypted at rest, always
Connection credentials are encrypted in the metastore with no configuration required and no way to turn it off. Commercial deployments can hold keys in your own vault instead.
No outbound calls to us
The software does not phone home, check a license server, or report usage. If your network blocks everything except your own sources, it still works.
Permission-aware AI
Copilot tools are scoped to the asking user's permissions. The assistant cannot read a pipeline, run or dataset that the person using it could not open themselves.
Signed execution records
Runs can emit Ed25519-signed receipts that are tamper-evident and verifiable offline, so evidence does not depend on log retention or on us.
Your identity provider, not ours
Server deployments sit behind your SSO. We do not operate an identity service, hold your user directory, or issue credentials for your people.
What we have, and what we do not
This is the section most vendors fill with badges. We would rather tell you the truth now than have you discover it during procurement.
SOC 2, ISO 27001 and similar
Revoluzen Technologies does not currently hold SOC 2 Type II, ISO 27001 or an equivalent attestation. We are early, and certification is a program we will undertake when it is genuinely warranted rather than as a procurement prop.
If your procurement process requires one today, tell us at the start. For self-hosted software the relevant controls are frequently your own, and we will help you document that honestly.
The properties you can check yourself
- ✓The orchestrator core is Apache-2.0 — you or your security team can read it.
- ✓It runs on your infrastructure, so your existing controls apply unchanged.
- ✓No telemetry and no license call-home, verifiable with a packet capture.
- ✓Receipts verify offline with a standalone open-source tool.
Reporting a vulnerability
If you have found something, we want to hear about it, and we will not be difficult about it.
Where to send it
security@revoluzen.ioPlease include the affected component and version, the steps to reproduce, and the impact as you see it. If you need to share something sensitive, say so and we will arrange a secure channel.
What we commit to
- 01We acknowledge every report, and we will tell you a real person's name.
- 02We assess and come back with our understanding of severity and a plan.
- 03We keep you updated until it is fixed, rather than going quiet.
- 04We credit you in the release notes unless you would rather we did not.
- 05We will not threaten you with legal action for reporting in good faith.
Check the claims, do not take them.
The orchestrator is Apache-2.0, so everything on this page about how it behaves is checkable against the code — once the repository is public, which it is not yet. Until then the behaviour is verifiable on an installed instance: run it and watch the network.