Trust and data handling

Your jump box → HTTPS (TLS 1.2 or better) → our ingest endpoint → your organisation's rows in our database. The collector refuses to send over plain HTTP and refuses to follow redirects. It never opens an inbound connection to your network, and we never connect to your database servers ourselves.

• SQL Server instance name, host name, edition, product version and patch level
• Environment and business labels you type in yourself (production, owner team, criticality)
• Database names, sizes, recovery model, encryption state and last backup timestamps
• Rule outcomes: the rule code, pass / fail / manual / not applicable / permission refused, and a short observed value such as a configuration number
• Login and role names where a rule is about privileged access (for example, members of sysadmin)
• The collector version, the account it ran as, and the start and end time of the scan

What it never reads or sends:

• Table data, column values, query text or query results from your databases
• Passwords, connection strings, certificates or private keys
• Backups, database files or memory dumps
• Anything at all from servers you do not point the collector at

The collector is published as plain, readable PowerShell. You can open it, read every query it runs, and check its signature and fingerprint before you run it.

A single SQL Server login with VIEW SERVER STATE, VIEW ANY DEFINITION and read access to system views. It needs no write permission of any kind. Where a permission is missing, the rule is reported as "permission refused" — never as a pass and never as a fail.

Data is held in a managed PostgreSQL database in a United States region, with encryption in transit and at rest. Every table is separated by organisation at the database level, so one customer's rows cannot be read from another customer's account. Access by us is limited to the named staff who operate the service.

• Supabase (managed PostgreSQL, authentication and storage) — United States
• Microsoft Azure (application hosting) — United States
• Cloudflare (edge delivery and TLS) — global network, US data region
• Stripe (payment processing; card data never reaches us) — United States
• Microsoft Azure Trusted Signing (code signing of released files) — United States

Scan results and findings are kept for the life of your engagement and for 12 months afterwards, so you can evidence a point in time. Write to rhoylle@rhoylle.com and we will delete your organisation's data within 30 days and confirm in writing. Billing records are kept for as long as United States tax law requires.

If we become aware of a breach affecting your data, we will notify your named contact within 72 hours with what we know, what we are doing, and what we need from you. Report a suspected vulnerability to rhoylle@rhoylle.com with "SECURITY" in the subject; we acknowledge within one business day and will not pursue good-faith researchers.

We are not SOC 2, FedRAMP or StateRAMP certified, and we do not hold an independent penetration test report yet. Compliance framework mappings in the product are a mapping to published control text — they are advisory, and they are not a certification or an audit opinion. We would rather tell you this now than have you discover it in a questionnaire.