Trust
What we hold, and what we do not.
Security posture covers what is enforced and how to check it. This page is the shorter, harder list: the certifications we do not hold, who processes anything on our behalf, and what an enterprise reviewer will ask for next.
Certifications
Rotascale holds no SOC 2 or ISO 27001 certification today. Both are deferred until a customer requires one, and the scope when we do it is small — we are audited on how we build and support, not on a platform holding your data, because we do not hold it.
RotaGrant is not a medical device and makes no HIPAA or FDA claim.
Subprocessors
For the software you run, there are none: RotaGrant processes no customer data outside your environment on any path. Subprocessors below are for this website and our own business, and none of them touch a governed record.
| Processor | Purpose | Data |
|---|---|---|
| Cloudflare | Website hosting and DNS | Request logs for rotascale.com |
| GitHub | Source hosting, published SDKs and specification | None of yours |
| Resend | Delivering the confirmation and the newsletter, if you ask for it | Your email address, and only if you gave it |
This site runs Google Analytics. It is the one third party we load, it sets a cookie, and we would rather say so here than let you find it in your network tab. It measures which pages get read; it is not connected to any RotaGrant deployment and there is no session recording, no advertising pixel, no chat widget and no A/B testing. The type is still served from this origin, and the content security policy names Google and nobody else. What it collects.