Data Security

Where your data lives

Messages, contacts, AI agents, appointments and account records are stored on dedicated servers in Germany, inside the European Union. Uploaded files, media and backups stay in the EU as well.

Generating an AI reply means sending the relevant message text to an AI provider, and some of those providers are established in the United States. Those transfers are covered by the European Commission's Standard Contractual Clauses or an applicable adequacy decision, as described in our Privacy Policy at https://app.rytheros.com/legal/privacy.

Encryption

• All traffic between your browser, the messaging channels, the API and the platform is encrypted in transit with TLS 1.2 or higher.
• Backups are encrypted at rest.
• Passwords are stored as salted hashes, never in plain text.
• Credentials and tokens for the third-party accounts you connect (messaging channels, calendars, CRMs, your own API keys) are stored encrypted and are never shown in full after you save them.

Who can access your data

• Your team: you decide who joins your account and what each person may see and do, with role-based permissions and optional sub-accounts for your own clients.
• Our staff and the platform provider's engineers: access is limited to what is needed to run and support the Service, granted by role, and bound by confidentiality obligations.
• Nobody else, unless you connect a third-party tool yourself or the law requires disclosure.

AI processing

• Message content is sent to AI providers only to generate the replies, summaries, transcriptions and search indexes you use.
• Providers process content under commercial API terms that do not allow it to be used to train their models.
• We do not train AI models on your data.
• You can bring your own AI API key where the Service supports it, in which case the AI provider is your own contractual partner.

Backups and recovery

• Automated encrypted backups are taken continuously and retained for up to 90 days for disaster recovery.
• Anything you delete from the live Service leaves backups within 90 days.
• Backups are restored only to recover from an incident, never to bring back data you chose to delete.

Retention and deletion

• Contacts and conversations are kept until you delete them, one at a time, per list, or through the API. You can also set inactive contacts to be deleted automatically after a period you choose.
• You can export your data at any time, and for 30 days after your account is closed.
• After that window, account data is deleted from the live Service and leaves backups within a further 90 days, unless the law requires us to keep it.
• Security and server logs are typically kept for up to 12 months.

Monitoring, testing and incident response

• The platform is monitored for errors, unusual traffic and failed sign-in attempts.
• Vulnerabilities are assessed regularly and dependencies are kept up to date.
• Sub-processors are assessed for security before they are onboarded and are bound by written data processing terms.
• If a personal data breach affects your data we will notify you without undue delay after becoming aware of it, with what happened, what is affected and what is being done, so you can meet your own obligations.

Certifications

The platform is not currently SOC 2 or ISO 27001 certified. We would rather say so than let a reviewer assume otherwise. The measures on this page, the Privacy Policy and the Data Processing Agreement are the documentation we can offer for a security review.

Reporting a security issue

If you find a vulnerability or believe your data has been exposed, email support@rytheros.com. We read every report and respond to genuine findings.

Who operates the Service

RytherOS is operated by Hrodebert Ryther LLC, with its registered address at 21902 Bahamas, Mission Viejo, CA 92692. Data protection contact: support@rytheros.com. General support: support@rytheros.com.