Privacy policy

• Account details: your name, work email address and a hashed password.
• Your company's compliance records: facilities, obligations, inspections, incidents, corrective actions, training records, and the documents you upload as evidence.
• Activity records: who created, changed, uploaded, opened or deleted records, and when, so your compliance history can be shown to an auditor.
• Technical data: IP address and browser details, used to keep you signed in securely and to limit abusive sign-in attempts.

• To provide the service: tracking obligations, reviewing evidence, building your audit package.
• To keep accounts secure and to investigate misuse.
• To contact you about your account and the service.

We do not sell your information, and we do not use your company's records or documents for advertising.

• Vercel — hosts the application (United States).
• Supabase — stores the database and files (AWS, us-east-1, United States).
• Anthropic— reads uploaded evidence to judge whether it meets the requirement. Under Anthropic's commercial terms, API data is not used to train their models by default.
• Cloudflare — routes email sent to our contact address.
• Resend — delivers account and invitation emails, once email sending is switched on.

Records are visible only to people your company's administrators have added, and only as far as their role allows. Rivetmoss staff access customer data only to support you or keep the service secure.

We keep your company's records while your account is active, because compliance evidence often has to be produced years later. When an account is closed we delete its records within 90 days, unless the law requires us to keep them longer.

You can ask us for a copy of your company's data, to correct it, or to delete it by emailing hello@rivetmoss.contact. Depending on where you live you may have further rights under laws such as the California Consumer Privacy Act; we honour those requests too.

If we change this policy in a way that matters, we will tell account administrators before it takes effect. Questions go to hello@rivetmoss.contact.