Security
How we protect your data
Rymi is a small team building on managed infrastructure. This page describes the
controls that are actually in place today, and is specific about which ones we
operate ourselves and which we inherit from our providers.
Infrastructure
- Encrypted in transit. API calls, audio streams, and webhook payloads are served over HTTPS by our hosting providers, with HSTS enabled on our API.
- Encrypted at rest. Call recordings, transcripts, and account data sit in Supabase Postgres and Supabase Storage, which encrypt data at rest at the platform level. Recordings are held in a private bucket reachable only through signed, expiring URLs.
- Encrypted credentials. Provider API keys, OAuth tokens, and carrier credentials get an additional layer of application-level AES-256-GCM encryption before they are stored, so they remain unreadable even with database access.
- Hosted on SOC 2 providers. Production runs on Railway and Supabase, both of which hold SOC 2 Type II. Rymi does not hold its own SOC 2 certification.
- Isolated tenants. Tenant data is scoped by row-level security in Postgres, and every API request is filtered by tenant. One customer's data is not reachable by another.
Application security
- Authentication. Handled by Supabase Auth, which hashes passwords with bcrypt and manages sessions and OTP verification. Rymi never sees or stores a password.
- API keys. Publishable keys for client-side use and secret keys for server-side use, separate by design and scoped to different capabilities.
- Rate limiting. API endpoints are rate-limited per API key and per IP address to protect availability.
- Input validation. Request bodies are schema-validated before processing.
- Webhook signatures. Inbound payment and provider webhooks are HMAC-verified; outbound webhooks are signed so you can verify they came from us.
Call security
- Call recordings are stored in a private bucket and reachable only through your authenticated dashboard or API.
- Transcripts and summaries are generated per call and stored under your account.
- Do-not-call suppression. Numbers you add to your do-not-call list are checked before every outbound call is queued and never reach your agent. This is your own suppression list — Rymi does not currently scrub against national DNC or DND registries, so meeting those obligations remains your responsibility.
- Consent detection tools help you identify and handle consent-related moments in calls.
Operational security
- Access controls. Production access is limited to the founder and the systems that need it.
- Audit logging. Administrative changes are recorded to an audit log with the acting account, action, and timestamp. Read access is not currently logged.
- Incident response. We will notify affected customers within 72 hours of confirming a breach, as required under GDPR.
- Dependency management. We monitor and patch dependencies for known vulnerabilities.
What we don't do
- We do not sell your data.
- We do not use your call data to train AI models.
- We do not use third-party advertising trackers.
- We do not store credit card numbers. Card details go directly to our payment processor, and we hold only a token.
A full list of the third-party services that process data on our behalf is in the Privacy Policy under "Subprocessors."
Responsible disclosure
If you discover a security vulnerability, please report it to security@rymi.live. We take every report seriously and will acknowledge it as quickly as we can.
Please do not publicly disclose vulnerabilities before we've had a chance to address them.
Questions
For security-related questions, contact security@rymi.live.