Data Security & Compliance
How Ripplemesh protects your data across AI services, infrastructure, and application layers — built on a certified, audited platform.
Ripplemesh is built on a SOC 2 Type II certified and ISO 27001 certified platform. Customer inputs and prompts are never used to train public AI models. All AI processing occurs server-side with industry-standard encrypted connections, and client data is isolated via row-level security and multi-tenant architecture. Ripplemesh is configured to exclude sensitive information from AI prompts, and all AI-generated demo data is clearly flagged for easy identification and removal. AI interactions are logged for compliance auditing.
1. Platform Certifications & Compliance
Security Certifications
SOC 2 Type II Certified: Ripplemesh runs on infrastructure that has completed an independent SOC 2 Type II audit, verifying controls for security, availability, and confidentiality. The full report is available under NDA upon request.
ISO 27001 Certified: Our platform maintains ISO 27001 certification, demonstrating a systematic approach to managing sensitive information through an Information Security Management System (ISMS).
GDPR Compliant: Ripplemesh is GDPR-compliant and offers a Data Processing Agreement (DPA) for customers who require one.
AI Model Training Policy
Customer inputs and prompts are never used to train public AI models. This is a documented platform-level commitment.
OpenAI API (Direct Calls): Per OpenAI's API terms, data submitted via the API is not used to train or improve OpenAI's models. This is a documented and widely referenced policy for API-tier customers.
Other AI Providers (Replicate, etc.): These providers have their own documented data handling policies that generally do not include using API inputs for model training. Customers should review each provider's current terms for the most up-to-date commitments.
2. Third-Party AI Service Usage
How Data Flows
Server-Side Only: All AI API calls (Replicate for image/video generation, OpenAI for text-to-speech) execute exclusively in backend functions, never from client browsers.
No Direct Client Access: API keys are stored as environment secrets and are only accessible to backend functions — never exposed to frontend code or client browsers.
Provider Data Retention: While Ripplemesh does not persist data sent to AI services, individual AI providers may temporarily retain request data per their own operational and abuse-prevention policies. Refer to each provider's data retention documentation for specifics.
Data Minimization
Only the minimum necessary context is sent to AI services (e.g., for image generation: the prompt only; for TTS: the text to speak only).
Ripplemesh is configured to exclude PII and sensitive organizational data from AI prompts unless explicitly required for a specific feature.
User content is isolated per request within our multi-tenant architecture.
3. LLM Configuration in Ripplemesh
AI Integration Channels
LLMs are used through two primary channels:
A. Our Managed LLM Integration
Runs on managed infrastructure using enterprise-tier AI providers.
Customer data is not used for model training per our documented policies.
Application data is isolated per tenant — your data is not accessible to other customers.
B. Direct OpenAI API Calls (in backend functions)
Used for specialized tasks (text-to-speech, question generation).
Per OpenAI's API Data Usage Policy, API inputs are not used for model training.
All calls execute server-side within a secure backend runtime environment.
Prompt Engineering for Security
Prompts are constructed dynamically in server-side backend functions.
Only necessary context is included (e.g., entity schemas, not individual user records where avoidable).
Sensitive fields (SSN, salaries, home addresses) are excluded from AI prompts by design.
When demo data is generated, it is clearly synthetic (e.g., using @demo.ripplemesh.com email addresses).
4. Data Protection Architecture
Infrastructure Level
Encryption in Transit: All communications use industry-standard HTTPS/TLS encryption.
Encryption at Rest: Data stored in our managed database uses industry-standard encryption at rest.
Access Controls: Row-Level Security (RLS) enforces role-based data access. Application administrators can access user data within their tenant as required for platform management.
Secrets Management: API keys and sensitive configuration are stored as environment secrets, inaccessible to frontend code.
Data Hosting
Data Residency: Our servers are currently located in the United States. Regional hosting options are not currently available. Customers with specific data residency requirements should evaluate this accordingly.
GDPR Compliance: Despite US-based hosting, Ripplemesh is GDPR-compliant and provides a Data Processing Agreement (DPA) for organizations that require one for cross-border data transfers.
Application Level
Row-Level Security: Entities have configurable RLS rules limiting data access by role (e.g., learners only see their own enrollments, managers see their direct reports).
Service Role Isolation: Backend functions use elevated privileges only when necessary and after user authentication verification.
Demo Data Flagging: All AI-generated demo data is tagged with
demo_data: true for easy identification, audit, and cleanup.AI-Specific Protections
Input Sanitization: Backend functions that call external AI services are configured to sanitize inputs and exclude PII where possible.
Audit Logging: AI interactions are tracked in the AIUsage entity for compliance review and cost monitoring.
Cost Controls: AI usage is tracked and can be limited to prevent unexpected costs.
5. Commitments & Documented Policies
What Ripplemesh Provides
Client data isolation: Your data is separated from other customers via our multi-tenant architecture with RLS enforcement.
AI model training protection: Customer data is never used for AI model training. OpenAI's API terms explicitly prohibit training on API inputs. Other providers have documented similar policies.
Demo data clearly marked: All synthetic data is flagged with
demo_data: true and can be removed.Role-based access: Configurable RLS rules control data visibility based on user role and identity.
Server-side AI calls: No AI API keys are exposed to client browsers.
Audit trail: AI usage is logged for compliance review.
For Security Questionnaires
Platform Certifications: SOC 2 Type II (audit report available under NDA) and ISO 27001 certified.
GDPR: Compliant, with DPA available upon request.
OpenAI API Terms: "OpenAI will not use data submitted via the API to train or improve models." (Documented in OpenAI's API Data Usage Policy.)
Data Hosting: United States only. No regional hosting options are currently available.
Encryption: Industry-standard encryption in transit (TLS) and at rest.
Access Model: Role-based access controls with row-level security. Platform administrators can access tenant data for operational support.
6. Best Practices & Recommendations
Implemented Safeguards
Backend functions authenticate users before processing AI requests.
Service role elevation is used only when required and after authentication verification.
AI usage is tracked in the AIUsage entity for audit and compliance.
Sensitive fields are excluded from AI prompts by application design.
Recommended Additional Safeguards
PII Sanitization Review: Periodically review backend functions to confirm PII exclusion from AI prompts remains effective as features evolve.
Explicit Consent: Consider adding user acknowledgment prompts before AI-generated content creation where appropriate.
Data Retention Policy: Implement scheduled cleanup of demo data and expired records per your organization's retention requirements.
Provider Policy Monitoring: Review AI provider terms periodically to ensure continued alignment with your organization's data handling requirements.