This is claim evidence. It gets treated that way.
RescueWRX holds photographs of people's homes, their addresses, and the record a dispute may turn on. The security posture below describes what is in place now, and separately what is committed but not yet done.
In place today
Encrypted in transit and at rest
TLS everywhere, with HSTS. Stored credentials for any connected system are sealed with AES-256-GCM and are never returned to a browser, including to the account that entered them.
Least privilege on every integration
A connected system is read with the narrowest scope that does the job. RescueWRX never requests the ability to create jobs or modify invoices, so it cannot, even if it were compromised.
Separated by organization
Every record is scoped to the company that owns it and that scope is enforced at the data layer, not in the interface.
A readable audit trail
Who captured a reading, who overrode a before-photo requirement, who changed an altitude. Documentation that can be edited silently is not evidence.
Committed, not yet done
Listed here rather than omitted, because the difference between holding a certification and intending to is exactly the thing a buyer is trying to find out.
- SOC 2 Type II. Not held today, and we will not imply otherwise.
- Independent penetration test, with the summary available under NDA.
- Customer-managed data export and deletion on request.
What we will not do with your data
We will not sell it, rent it, or share it with a carrier, a third-party administrator, or a lead broker. The documentation you capture is yours and your customer’s.
We will not train a model on your photographs or your customers’ addresses.
We will not hold your data hostage. If you leave, you take a complete export of every loss, every photograph and every reading with you.
Found a vulnerability? Tell us and we will respond within two business days.