Security & Compliance FAQ
Last updated: July 2, 2026
Need a security packet or have questions not covered here? Email support@corenet.solutions with your organization name and we will help with your vendor review.
Frequently asked questions
Is Ripple SOC 2 certified?
Ripple is not SOC 2 Type II certified at Initial Launch. We follow security practices aligned with common vendor review expectations — encryption in transit and at rest for sensitive tokens, role-based access, and row-level data isolation. Enterprise customers can request our security overview and discuss certification roadmap with our team.
Do you support GDPR and data subject requests?
Yes. We publish a privacy policy, maintain a subprocessor list, and support access, correction, export, and deletion requests. During Initial Launch, export and deletion are handled manually by our support team, typically within 30 days. See our Privacy requests help article for how to submit a request.
Where is customer data stored?
Application data is stored in Supabase (PostgreSQL) with region selection at project setup (US or EU). The web application is hosted on Vercel. See our Subprocessor list for the full third-party stack and data categories each provider processes.
How are LinkedIn credentials handled?
Employees connect LinkedIn via LinkedIn OpenID (OAuth) — the same secure authorization flow used by other business tools. Ripple never stores LinkedIn passwords. Access tokens are encrypted at rest and used only to publish approved shares and retrieve basic profile identifiers needed for the product.
What encryption and access controls are in place?
All traffic uses HTTPS (TLS). LinkedIn tokens and other sensitive credentials are encrypted at rest. Inside the product, organizations are isolated with row-level security in the database. Role-based permissions (owner, admin, marketing, employee) limit who can manage billing, content, invites, and sharing.
Do you support SSO or SAML?
SAML SSO is available on our Enterprise plan for organizations that require centralized identity management. Self-serve teams on Standard plans use email and password authentication with optional two-factor authentication where enabled.
Can we complete a vendor security questionnaire?
Yes. Email support@ripples.marketing with your questionnaire or security review packet. We typically respond within five business days for standard vendor assessments during Initial Launch.
What subprocessors does Ripple use?
We use Supabase, Vercel, Stripe, LinkedIn, Resend, Sentry, Upstash, and optional AI providers when AI assist is enabled. Each subprocessor, purpose, and data category is listed on our Subprocessor page.
Do you store payment card numbers?
No. Billing is handled by Stripe. Ripple stores Stripe customer and subscription identifiers only — not full card numbers or CVV data.
How do you handle security incidents?
We monitor application errors and reliability through Sentry and infrastructure alerts from our hosting providers. If you believe you have found a vulnerability, contact us at security@ripples.marketing. We investigate reported issues and notify affected customers when required.
Can we sign a Data Processing Agreement (DPA)?
Yes. Organizations that require a DPA for GDPR or similar regulations can request one during procurement. Contact our team at support@ripples.marketing and include your legal entity name and primary contact.
Related guides
- Privacy Policy
- Subprocessor list
- Privacy requests
- Terms of Service
Ready to launch employee advocacy?
Start your 30-day free trial. $249/month (first 20 users included).