Trust

Security at REAP

Last updated: August 6, 2026

Security is foundational to everything we build. REAP operates as the reasoning layer for enterprise networks, which means our customers entrust us with telemetry, configuration, and operational data from systems that keep their business running. We protect that trust with a defense-in-depth program that spans our infrastructure, our application, our people, and our processes.

Compliance status

We believe security claims should be specific about what has been independently verified and what has not. Our current status:

  • SOC 2 Type II: attestation in progress. Our audit is underway with a target completion of Q3 2026. The report will be available under NDA once issued.
  • ISO 27001 and NIST CSF: aligned, not certified. Our written information security program is built to these frameworks and is reviewed annually, but we do not currently hold certification against either.
  • Penetration testing: completed annually by an independent third party, with summary letters available under NDA.
  • Privacy: GDPR, UK GDPR and CCPA/CPRA. See our Privacy Statement.

Our security program

REAP maintains a written information security program aligned with industry frameworks including SOC 2, ISO 27001, and the NIST Cybersecurity Framework. The program is owned by executive leadership, reviewed at least annually, and continuously monitored through automated controls and independent audits.

  • Governance. Security policies covering access, change management, incident response, vendor risk, and acceptable use are reviewed and approved annually.
  • Risk management. Risks are assessed continuously and tracked through a formal register with owners, severities, and remediation timelines.
  • Continuous monitoring. Controls are monitored in real time using compliance automation, with deviations triaged on a defined SLA.

Infrastructure security

REAP runs entirely on Amazon Web Services in U.S. regions. We inherit AWS's physical and environmental controls and layer our own network, identity, and workload protections on top.

  • Network isolation. Production workloads run in private VPCs with strict ingress/egress rules. Public endpoints are placed behind managed load balancers with WAF protection and DDoS mitigation.
  • Hardened compute. All workloads run on minimal, regularly patched base images. Production hosts have no shell access; changes ship through code.
  • Secrets management. Secrets are stored in a managed secrets vault, scoped per environment, and never written to source control or logs.
  • High availability. Services are deployed across multiple availability zones with automated failover and tested backup restores.

Application security

Security is built into our software development lifecycle from design through deployment.

  • Secure SDLC. Threat modeling is performed for new features touching sensitive data. All code requires peer review before merge.
  • Static and dependency scanning. Every pull request is scanned for code vulnerabilities, secrets, and vulnerable dependencies. High-severity findings block release.
  • Dynamic testing. Pre-production environments are continuously tested, and third-party penetration tests are performed at least annually with summary letters available under NDA.
  • Change management. All production changes are tracked, reviewed, and deployed through automated CI/CD with full audit history.

Data protection

We protect customer data through encryption, isolation, and minimization.

  • Encryption in transit. All traffic to and from REAP is encrypted with TLS 1.2 or higher. Internal service-to-service traffic is also encrypted.
  • Encryption at rest. All customer data is encrypted at rest using AES-256 with keys managed through AWS KMS.
  • Tenant isolation. Customer data is logically segregated and access is enforced at the application layer with row-level controls.
  • Data minimization. We collect only what we need to deliver the service, and we provide configurable retention windows for operational telemetry.

Identity and access management

  • Least privilege. Access to production systems is granted on a need-to-know basis, reviewed quarterly, and revoked promptly upon role change or offboarding.
  • Strong authentication. All employee access to internal systems and cloud consoles requires SSO with phishing-resistant multi-factor authentication.
  • Customer SSO. Enterprise customers can enable SAML / OIDC single sign-on for their REAP workspace.
  • Auditability. Administrative actions and access events are logged and retained for forensic review.

Vulnerability management

  • Continuous scanning of infrastructure, container images, and dependencies.
  • Defined remediation SLAs by severity: critical issues are addressed within 7 days, high within 30 days, medium within 90 days.
  • Annual third-party penetration testing across application and infrastructure scopes.

Incident response

REAP maintains a documented incident response plan that is tested at least annually. On-call engineers are paged on detection, incidents are triaged using a documented severity model, and root-cause analyses are produced for material incidents. We commit to notifying affected customers without undue delay if their data is impacted, in line with our contractual and regulatory obligations.

Business continuity and disaster recovery

Production data is backed up continuously, with point-in-time recovery and geographically distributed copies. Recovery procedures are documented and exercised on a recurring basis to validate our recovery time and recovery point objectives.

People security

  • Background checks are performed on all employees prior to hire, where permitted by law.
  • All personnel complete security and privacy awareness training at hire and annually.
  • Engineers handling sensitive systems receive additional secure-coding training.
  • Confidentiality obligations are part of every employment and contractor agreement.

Vendor and sub-processor management

We perform security and privacy due diligence on every vendor that may process customer data, and we contractually require appropriate safeguards. Our list of sub-processors and the regions in which they operate is published in our Privacy Statement.

Privacy and compliance

REAP is committed to operating in compliance with applicable privacy laws, including the EU GDPR, UK GDPR, and the California Consumer Privacy Act (CCPA/CPRA). For details on how we handle personal data, please see our Privacy Statement.

Reporting a vulnerability

We welcome reports from security researchers and the broader community. If you believe you have found a security issue affecting REAP, please email security@reapitnow.ai with a description of the issue, steps to reproduce, and any supporting material. Please do not publicly disclose the issue until we have had a reasonable opportunity to investigate and remediate.

Contact

For security questionnaires, audit reports, or trust-and-compliance requests, please reach out to security@reapitnow.ai.