This Security & Compliance Statement describes the safeguards and governance program Redeyed Corporation uses to protect its Services and customer information. It is a transparency statement, not an independent audit report, certification, warranty, service-level agreement, or promise that any particular safeguard will eliminate every risk.
Current assurance status. Redeyed is implementing an internal control program designed to align with the AICPA Trust Services Criteria used in SOC 2 examinations and ISO/IEC 27001:2022, including applicable amendments. Redeyed has not yet completed a SOC 2 examination and is not currently certified to ISO/IEC 27001. We will not represent otherwise unless and until an independent CPA firm issues the applicable SOC report or an accredited certification body issues a valid certificate.
Our internal security program is designed to cover the Redeyed websites and Laravel applications, APIs, production infrastructure, databases, Windows, macOS, and iOS clients, and the people and material service providers that build, operate, administer, or support those systems. Specific audit or certification boundaries may be narrower and will be stated in the applicable independent report or certificate.
We maintain an integrated control register with assigned owners, operating frequencies, evidence requirements, review dates, exceptions, and mappings to relevant SOC 2 and ISO/IEC 27001 areas. Our program is designed to include periodic risk assessment, risk treatment, policy review, management oversight, internal review, corrective action, and retention of evidence showing whether controls operated as intended.
Safeguards supported by the Services include role-based authorization, least-privilege administration, multi-factor authentication, TOTP, WebAuthn security keys, recovery controls, scoped API credentials, IP restrictions where configured, session and device management, and audit records. Customers remain responsible for selecting administrators carefully, enabling available authentication protections, safeguarding credentials, reviewing their users, and promptly revoking access that is no longer required.
We use measures designed to protect information in transit and sensitive information at rest, including TLS, password hashing, application encryption, encrypted credential and key storage, and platform-protected credential storage in supported desktop and mobile clients. We also use retention, redaction, access-control, and deletion mechanisms appropriate to the data and feature. Further information about the categories and purposes of processing appears in our Privacy Policy.
Our program is designed to cover reviewed changes, source control, automated testing, controlled deployments, security logging, first-party usage analytics, vulnerability identification, remediation tracking, malware and abuse detection, defensive target authorization, and coordinated vulnerability disclosure. Security and client telemetry may be retained as necessary to investigate abuse, establish an audit trail, operate the Services, and comply with law, subject to our Privacy Policy.
We maintain backup, restoration, monitoring, incident-response, escalation, and business-continuity processes designed for the nature and scale of the Services. We test and improve these processes over time. No online system can guarantee uninterrupted availability, perfect recovery, or absolute security; contractual availability commitments, if any, apply only when stated in a signed order form or service-level agreement.
We assess material providers based on the information and access involved, limit their use of information to the services they provide, and seek appropriate confidentiality, security, privacy, availability, deletion, and incident-notification commitments. Payment processors and other independently controlled services may also apply their own terms and privacy practices. A current subprocessor disclosure or Data Processing Addendum may be requested at [email protected].
Redeyed secures the infrastructure and application components under its control. Customers are responsible for their accounts, endpoints, networks, configurations, integrations, content, users, legal bases and notices, backup of exported materials, and lawful use of scans and security tools. A Redeyed report, scan, recommendation, control mapping, or automated check is a point-in-time aid and does not replace the customer's own risk assessment, professional advice, monitoring, patching, or governance.
Redeyed may provide control mappings, evidence collection, readiness scoring, policy workflows, risk tracking, reports, and remediation tools. These features support a compliance program but do not constitute legal advice, an audit, an attestation, certification, regulatory approval, or a guarantee of compliance. A customer's compliance depends on its own scope, facts, configurations, people, vendors, policies, and consistent operation of controls.
A SOC 2 report is issued only by an appropriately qualified independent CPA firm for the system and period stated in that report. ISO/IEC 27001 certification is issued only by a certification body for the organization and scope stated on the certificate. If Redeyed later obtains either form of assurance, we will identify the exact entity, scope, criteria or standard version, period or validity dates, and report-access conditions without overstating what was examined.
Security researchers may use our coordinated vulnerability disclosure process or consult security.txt. Security incidents and urgent concerns may be reported to [email protected]; privacy and legal questions may be sent to [email protected].
Redeyed CorporationRelated documents: Terms of Service, Privacy Policy, and Acceptable Use Policy.
