Your data stays yours.
How Rubicon protects, segments and handles the data you bring to it, in plain answers to the questions security teams ask us most.
Your inputs, uploads and reports are never used to train AI models.
Isolated by customer, then by deal, then by role.
TLS 1.2+ in transit, AES-256 at rest, US-hosted.
Every sign-in, query and export is on the record.
Your data and AI
Do you use our data to train AI models?
No. Nothing you put into Rubicon is used to train AI models: not your inputs, your uploaded documents, or the reports Rubicon produces for you. That applies to Rubicon and to every AI model provider we use.
Our AI providers process your data under commercial terms that prohibit them from using it to train their models. They process it only to return a result to you.
Is our data used to improve Rubicon for other customers?
No. Your deal data is never pooled with other customers’ data and never shows up in anyone else’s results. Rubicon’s research draws on public and licensed sources, not on what customers bring to the platform.
What does the AI actually see?
Only what it needs to complete the task you asked for, such as the company you are screening and the documents you attach to that deal. Each request is processed for your workspace and returned to it.
How input data is segmented
How is our input data kept separate from other customers?
Each customer gets its own workspace. Every record, upload and report is tied to that workspace, and the server checks access on every request. One customer cannot query, search or see another customer’s data.
- By customer: each workspace is isolated from every other.
- By deal: inside a workspace, a screen or diligence file is visible only to the team members added to that deal.
- By role: admins control who can view, run, export and share.
Can people on our own team see every deal?
Only if you set it up that way. Access is granted deal by deal, so you can run a sensitive project with a small group without it appearing for the rest of the firm.
How are uploaded documents protected?
Uploads are stored inside your workspace, encrypted, and are only reachable through an authenticated session with access to that deal. They are not shared, indexed for other customers, or used to train models.
Infrastructure and encryption
Where is Rubicon hosted?
Rubicon runs on a leading US cloud provider whose data centers hold SOC 2 Type II and ISO 27001 certifications. Customer data is stored in the United States.
Is data encrypted?
Yes. Data is encrypted in transit with TLS 1.2 or higher and encrypted at rest with AES-256.
How do you protect the platform itself?
We keep production separate from development, apply least-privilege access to every system, keep dependencies patched, and monitor for unusual activity.
Access and accountability
Who at Rubicon can access our data?
A small number of authorized staff, only when needed to operate the service or support you, and only with multi-factor authentication. Every access is logged.
How do your users sign in?
With Google, Microsoft or LinkedIn, with your company’s single sign-on, or with a work email. Every sign-in is over an encrypted connection and is logged.
Is activity logged?
Yes. Every query, report and export is logged with who did it and when. Workspace admins can request their audit log at any time.
Where Rubicon’s data comes from
What sources does Rubicon use?
Public records and licensed data: corporate registries, court and regulatory filings, IP offices, lien and UCC records, sanctions lists, news and other published sources. Every finding links back to its source.
Do you scrape private or gated data?
No. Rubicon does not scrape private or login-gated data and does not get around paywalls or access controls.
Retention and deletion
How long do you keep our data?
For as long as your account is active, or less if you delete it sooner. You control your workspace and can delete deals, uploads and reports at any time.
What happens when we leave?
At the end of your contract we delete your workspace data within 30 days, or sooner on written request, and confirm the deletion in writing.
Compliance and reviews
Are you SOC 2 certified?
Our SOC 2 Type II program is in progress. In the meantime we’re happy to walk your team through our controls and complete your security questionnaire.
Can you sign an NDA or a data processing agreement?
Yes. We regularly work under NDA, and a data processing agreement is available on request.
What happens if there is a security incident?
We investigate right away, contain the issue, and notify affected customers promptly, in line with our contract and applicable law.
How do I report a vulnerability?
Email hello@rubiconos.com with “Security” in the subject line. We review every report.
Send us your security questionnaire or set up a call with our team. We’ll walk through our controls in detail.