Security
Most of a security questionnaire asks how a vendor protects data you send them. You do not send us any. RotaGrant is deployed in your cloud account or your data centre, and the parts of it that could reach outward are enumerable, disabled by default, and refused outright in airgapped mode.
Every claim below names the thing that enforces it. Our certification position is on the trust page; this one is about what the software does.
What reaches us
Nothing.
No telemetry, ever
No licence check, no update check, no crash reporter, no analytics. A test fails the build if any of them appear, and a second test fails the build if any module opens a network connection without appearing in the egress inventory.
No model provider
The platform calls no LLM on any code path. Payloads carry prompts, responses and tool arguments — sending those to a provider would exfiltrate the exact data the product exists to protect.
Airgapped is a control
With airgapped mode set, the deployment refuses to start if any setting selects a service outside your network. Checked at startup, not at first use.
Tenancy in the database
Row-level security in PostgreSQL rather than application code. A query that forgets its workspace filter returns nothing, rather than everything.
Hold the signing key yourself
Evidence is signed so it can be verified afterwards. Who holds that key decides what the signature is worth, so custody travels with every signed artifact.
deployment
The key is on the server. The operator could re-sign a rewritten history.
kms / hsm
Non-exportable. They can sign new records, not extract the key.
external
You hold it. RotaGrant cannot sign without you.
A private key is never uploaded, pasted, downloaded or exported — the capability is
absent from the interface rather than present and forbidden. And if you take
external custody, you can verify it: withdraw the sign permission and
confirm sealing stops.
The limits of this page
External custody is a declaration: nothing in the platform can verify who owns a key, because the API call is identical either way. What makes it checkable is that you can revoke access and watch sealing stop — and that is the difference between a control you can test and one you are asked to believe. A full security questionnaire, answered, is available on request: dev@rotascale.com.