Security & Data Protection

• Authentication: Secure password-based authentication with bcrypt hashing
• Session Management: Secure session tokens with automatic expiration
• Role-Based Access: Internal team members have role-based access controls (least privilege principle)
• Multi-Factor Authentication (MFA): Available for account holders (recommended)
• Password Requirements: Strong password policies (minimum length, complexity)
• Account Lockout: Automatic lockout after repeated failed login attempts

Infrastructure Security

Security Audits & Testing

• Regular Security Audits: Periodic internal security reviews
• Vulnerability Scanning: Automated scanning for known vulnerabilities
• Penetration Testing: Periodic third-party security assessments
• Code Reviews: Security-focused code reviews before deployment
• Dependency Management: Regular updates of libraries and dependencies

C5 Framework Compliance

As mentioned on our investors page, Rankad.ai follows the Cloud Computing Compliance Criteria Catalogue (C5) framework established by the German Federal Office for Information Security (BSI).

C5 covers:

• Organization of information security
• Physical security
• Human resources security
• Asset management
• Access control
• Cryptography
• Operations security
• Communications security
• Incident management
• Business continuity
• Compliance with legal requirements

Data Backup & Recovery

• Automated Backups: Daily automated backups of all customer data
• Encrypted Backups: All backups are encrypted before storage
• Geo-Redundancy: Backups stored in multiple geographic locations
• Retention: Backups retained for 30 days (rolling window)
• Disaster Recovery: Tested disaster recovery procedures to restore service

If a security incident occurs:

1. Detection: Security monitoring systems alert us to potential incidents
2. Assessment: We immediately assess the scope, severity, and impact
3. Containment: We take steps to contain and stop the incident
4. Notification:
   • Authorities notified within 72 hours (GDPR requirement)
   • Affected users notified promptly if personal data is compromised
5. Remediation: We fix vulnerabilities and strengthen security
6. Post-Incident Review: We analyze the incident and improve our processes

Employee Access & Training

• Background Checks: All employees undergo background checks
• Security Training: Regular security awareness training for all staff
• Least Privilege: Employees only have access to data necessary for their role
• Access Logging: All employee access to customer data is logged
• NDA & Confidentiality: All employees sign non-disclosure agreements
• Offboarding: Access is immediately revoked when employees leave

Third-Party Service Security

We carefully vet all third-party services and processors:

• Due Diligence: Security and privacy assessments before integration
• Data Processing Agreements: GDPR-compliant DPAs with all processors
• Regular Reviews: Ongoing monitoring of third-party security practices
• Minimal Data Sharing: Only share data necessary for service delivery

See our Privacy Policy for a list of third-party services we use.

Your Security Responsibilities

Help us keep your account secure:

• Strong Passwords: Use unique, complex passwords (minimum 12 characters)
• Password Manager: Consider using a password manager
• Enable MFA: Enable multi-factor authentication on your account
• Don't Share Credentials: Never share your password or account access
• Secure Devices: Keep your devices updated and protected with antivirus
• Public Wi-Fi: Avoid accessing sensitive data on public Wi-Fi
• Phishing Awareness: Be wary of emails claiming to be from Rankad.ai - verify sender
• Report Suspicious Activity: Contact us immediately if you notice anything unusual

Reporting Security Vulnerabilities

Found a security vulnerability? We appreciate responsible disclosure.

How to report:

• Email kontakt@rankad.ai with subject "Security Vulnerability"
• Provide detailed description of the vulnerability
• Include steps to reproduce (if applicable)
• Allow us reasonable time to investigate and fix before public disclosure

We commit to:

• Acknowledge your report within 48 hours
• Investigate and respond promptly
• Keep you informed of our progress
• Credit you (if desired) when the issue is resolved

Security Updates

This security page is updated regularly to reflect changes in our security practices. For questions about our security measures, contact kontakt@rankad.ai.