Trust
What we hold, and what we do not.
Security posture covers what is enforced and how to check it. This page is the shorter, harder list: the certifications we do not hold, who processes anything on our behalf, and what an enterprise reviewer will ask for next.
Certifications
Rotascale holds no SOC 2 or ISO 27001 certification today. Both are deferred until a customer requires one, and the scope when we do it is small — we are audited on how we build and support, not on a platform holding your data, because we do not hold it.
RotaGrant is not a medical device and makes no HIPAA or FDA claim.
Subprocessors
For the software you run, there are none: RotaGrant processes no customer data outside your environment on any path. Subprocessors below are for this website and our own business, and none of them touch a governed record.
| Processor | Purpose | Data |
|---|---|---|
| Cloudflare | Website hosting and DNS | Request logs for rotascale.com |
| GitHub | Source hosting, published SDKs and specification | None of yours |
| Resend | Delivering the confirmation and the newsletter, if you ask for it | Your email address, and only if you gave it |
No analytics, no session recording, no advertising pixels, no chat widget, and no third-party fonts — the type on this page is served from this origin, and the content security policy forbids any other. On a site claiming your data stays with you, loading a font from somebody else's server would be a small lie told on the page making the claim.