Revelara helps engineering teams find and prevent reliability risk. Because that work can touch source code and incident data, we treat the security of your data as foundational. This page summarizes how we protect it and where we are on our compliance roadmap. Our current subprocessors are listed in our Privacy Policy. To request a Data Processing Agreement or details of our security posture, email trust@revelara.ai.
Data handling model
Revelara is designed to minimize the data that ever leaves your environment.
- Local-first analysis. The Revelara scanner and
rvl CLI run entirely within your own environment. Your source code is analyzed locally and does not leave your infrastructure; only the risk findings you choose to share are transmitted. Source code never reaches Revelara's infrastructure, and is never sent to third-party model providers. - Bring your own data. Where you connect data to the hosted platform, it is scoped to your organization and used only to provide the Service to you.
- Data minimization. We collect the minimum needed to deliver risk analysis, and we do not sell customer data.
Infrastructure & application security
- Tenant isolation. Every record is scoped to your organization and enforced at the database layer with PostgreSQL row-level security, so one organization can never read another's data. Our isolation controls are covered by an automated test suite.
- Encryption in transit and at rest. All traffic is served over TLS, and internal service-to-service traffic on the administrative path uses mutual TLS. Data is encrypted at rest by the cloud platform. Two categories are additionally encrypted at the application layer with AES-256-GCM before they are stored: the credentials for any third-party integration you connect, and session cookies.
- Sign-in and MFA. There are three ways to sign in to Revelara. Two are federated: a social identity provider (Google, GitHub, or Microsoft) on every plan, and SAML single sign-on from your own identity provider on Enterprise. On both of those, the second factor is enforced by the identity provider you configure, subject to how you have configured it. The third is an email address and a password. On that path the credential is held by our identity provider, WorkOS, we store no password material ourselves, and your own MFA enforcement does not reach it. Each user who signs in this way can turn on a second factor for their own account with an authenticator app. If you’d like MFA enforced across your organization, email support@revelara.ai and we can enable this for you. Access is role-based and least-privilege.
- Secrets management. Credentials are held in a managed secret store and are never committed to source control or container images.
- Secure development. Changes ship through version control with automated tests, linting, and required checks, plus automated security scanning (static analysis, dependency, and container scanning) in our CI pipeline.
- Hosting. The platform runs on Google Cloud Platform in a continuously reconciled, declarative configuration.
- Backups and recovery. The production database is continuously backed up with point-in-time recovery and runs with a synchronous standby for high availability.
- Monitoring. Systems are monitored with metrics, uptime checks, and alerting.
Compliance
- SOC 2. Revelara is a young company and is actively working toward SOC 2 Type II. We are implementing the required controls and collecting evidence now; the report is not yet complete. We are glad to walk prospective customers and their security teams through our current posture and roadmap on request.
- GDPR and data processing. A Data Processing Agreement is available on request. Our Privacy Policy describes how we handle personal data.
- Subprocessors. A current list of the subprocessors we use to operate the Service is published in our Privacy Policy.
Reporting a vulnerability
We welcome responsible disclosure. If you believe you have found a security vulnerability in Revelara, email trust@revelara.ai with details and steps to reproduce. Please give us a reasonable opportunity to investigate and remediate before any public disclosure. We will acknowledge your report and keep you updated on our progress.
Contact
For any security, privacy, or compliance question, or to request a DPA:
Revelara AI LLC
Security & Trust: trust@revelara.ai
Website: https://revelara.ai