Security
Rulebook keeps the access tokens of your tools encrypted, keeps each customer's data apart, and asks only for the permissions that the work needs. It removes secrets before each AI model call. Rulebook does not hold SOC 2 or ISO 27001 certification today.
Your connected tools
- The access tokens of connected tools are encrypted (AES-256-GCM), with a separate key for each customer.
- Each connection asks for narrow permissions. For example, with Google Drive, Rulebook can open only the files that it made or that a person opened with it.
- A customer can remove Rulebook's access in each connected tool at any time.
Your data
- Data moves over encrypted connections (TLS).
- Each customer's data is kept apart from the data of other customers.
- A person sees only the work items that they may see. For example, when the host or an admin marks a meeting private, only the people in the meeting and the owner of each item see its items.
- We delete a customer's data within 30 days of a request, and we confirm when it is done.
People stay in control
- Each work item gets an owner before Rulebook acts on it. Rulebook acts with the access that your admin gives the Rulebook connection.
- By default, Rulebook asks the owner before it changes a record. It always asks a person before it sends an email to your customers or does a legal or financial step.
- Rulebook records approvals, changes of owner and status, and each step that changes something in a tool. Each run keeps a receipt.
AI models
- Rulebook uses AI models through the business services of Anthropic (language) and Voyage AI (search). We send only the text that a task needs.
- Before each call, Rulebook removes secrets such as passwords, keys and access tokens from the text. It also checks the text of each PDF for secrets. Our logs keep only the count.
- Our record of each AI model call keeps the task, the model, the tokens and the cost. It keeps no prompts, no model output and no customer text.
Certifications
Rulebook does not hold SOC 2 or ISO 27001 certification today. We build Rulebook to the SOC 2 controls (encryption of stored credentials, least-privilege access, audit logs) and plan a SOC 2 audit as we grow.
In development
- Single sign-on (SAML), for example with Okta.
- Roles and permissions for admins, managers and members.
- Automatic user setup from your identity provider (SCIM).
- A full audit log view for admins.
Report a security issue
Write to support@getrulebook.com. The privacy policy lists the providers that process data for Rulebook.
Rulebook is in early development. We start pilots with a small number of teams. Join the waitlist