Security Overview
Last updated: August 26, 2026
Audience: Prospective and current customers' security, procurement, and risk teams.
This document summarizes how RidgePoint protects customer data. It is a trust document, not a contract. Binding terms are in our Master Services Agreement and Data Processing Agreement.
We sell a vendor-risk product, so we expect this document to be read closely and followed by a formal questionnaire. Everything below describes controls that are in place today. Anything not yet implemented is explicitly marked planned.
1. Company and architecture summary
Gillespie Technologies Inc., doing business as RidgePoint Risk Advisory, runs a hosted vendor-risk management portal:
- Public marketing site and lead capture.
- Authenticated client dashboard covering clients, vendors, assessments, remediation, and reports.
- Tokenized public vendor assessment response pages.
Hosting model: shared multi-tenant staging and production, architected to support future isolated client instances. Hosted on Vercel (application) and Supabase (database, authentication, storage).
2. Data protection controls
| Area | Control |
|---|---|
| Encryption in transit | TLS for all traffic to the Site and APIs. HSTS enabled. |
| Encryption at rest | Database and storage encrypted at rest by the platform provider. |
| Tenant isolation | Postgres Row Level Security enforces per-tenant access; client-scoped writes are gated by membership and role checks. |
| Access control | Least-privilege. Service-role credentials are used only in server-only code paths and are never exposed to the browser. |
| Vendor assessment links | Tokenized. Only token hashes are stored server-side. |
| Evidence files | Stored in private Supabase Storage. Downloads are served through short-lived signed URLs only. |
| Authentication | Supabase Auth. Invite links are routed through the canonical domain rather than raw provider verify URLs. |
| Secrets management | Service-role keys and secrets are held in the server environment only — never in client code, logs, or documentation. |
| Tracking | No third-party advertising, cross-site tracking, or behavioral analytics cookies are used on the Site. |
3. Subprocessors
We use the following subprocessors to deliver the Services. We notify customers of material changes per our Data Processing Agreement.
| Subprocessor | Purpose | Data processed | Location |
|---|---|---|---|
| Vercel Inc. | Application hosting and CDN | Request data, application traffic | United States |
| Supabase Inc. | Postgres database, Auth, Storage | Account, assessment, and evidence data | United States |
| Resend | Transactional and invite email | Recipient email address, invite content | United States |
| Google LLC (Google Workspace) | Human business email; not an application data store | Business correspondence | United States |
4. Operational security
- Environment separation: staging and production are separate projects. Production data is treated as non-disposable.
- Migrations: forward-only, timestamped, and reviewed. Schema changes are tracked in version control.
- Change management: small, verified slices. Lint, build, and mutation QA run before merge.
- Logging: application and authentication logs are retained for security monitoring. Secrets are never logged.
- Email integrity: Transactional email is DKIM-signed and covered by a published DMARC policy, and sender addresses are restricted to our sending domain. SPF alignment and a move to an enforcing DMARC policy are in progress.
5. Data handling and retention
- Customer Data is processed only to provide the Services and according to customer instructions.
- On termination, data is deleted or returned per the Data Processing Agreement, within 30 days.
- We do not sell customer or personal data.
6. Incident response
We maintain an incident response process covering detection, containment, assessment, notification, and remediation. We will notify affected customers without undue delay, per the Data Processing Agreement.
7. Compliance posture
- Current: Privacy Policy and Data Processing Agreement available. Security controls as described above.
- Planned: SOC 2 Type II readiness as the customer base grows. We do not currently hold a SOC 2 report and do not claim one.
- Privacy: US state privacy laws, including CCPA and CPRA, are addressed through our Privacy Policy and Data Processing Agreement.
8. Contact
Security questions, questionnaires, and vulnerability reports: security@ridgepointrisk.com
Gillespie Technologies Inc., doing business as RidgePoint Risk Advisory