Security
You do not send us any data.
Most of a security questionnaire asks how a vendor protects the data you send them. RotaGrant is deployed in your cloud account or your data centre, and the parts of it that could reach outward are enumerable, disabled by default, and refused outright in airgapped mode.
Every claim below names the thing that enforces it. Our certification position is on the trust page; this one is about what the software does.
What reaches us
Nothing.
This section is about a deployment of RotaGrant in your environment, not about this website. rotascale.com itself runs Google Analytics and says so; a deployment sends nothing anywhere, and the tests below are what hold that.
No telemetry, ever
No licence check, no update check, no crash reporter, no analytics. A test fails the build if any of them appear, and a second test fails the build if any module opens a network connection without appearing in the egress inventory.
No model provider
The platform calls no LLM on any code path. Payloads carry prompts, responses and tool arguments — sending those to a provider would exfiltrate the exact data the product exists to protect.
Airgapped is a control
With airgapped mode set, the deployment refuses to start if any setting selects a service outside your network. Checked at startup, not at first use.
Tenancy in the database
Row-level security in PostgreSQL rather than application code. A query that forgets its workspace filter returns nothing, rather than everything.
Hold the signing key yourself
Evidence is signed so it can be verified afterwards. Who holds that key decides what the signature is worth, so custody travels with every signed artifact.
deployment
The key is on the server. The operator could re-sign a rewritten history.
kms / hsm
Non-exportable. They can sign new records, not extract the key.
external
You hold it. RotaGrant cannot sign without you.
A private key is never uploaded, pasted, downloaded or exported — the capability is
absent from the interface rather than present and forbidden. And if you take
external custody, you can verify it: withdraw the sign permission and
confirm sealing stops.
Custody is a declaration. Here is how to test it.
External custody is a declaration: nothing in the platform can verify who owns a key, because the API call is identical either way. What makes it checkable is that you can revoke access and watch sealing stop — and that is the difference between a control you can test and one you are asked to believe. A full security questionnaire, answered, is available on request: [email protected].
Take it with you
What runs where, what can leave, what we hold and what we do not — including the certifications we do not have. Download.
What a design partner gets, what we ask in return, and what it costs. Download.
A completed security questionnaire, the egress inventory and the architecture are kept ready rather than assembled per deal — ask [email protected] and they arrive the same day.