Start a proof of value Book a demo
Preview: under engineering review. This documentation is a working draft prepared from the security packet and reference architecture. Items marked to confirm are placeholders for REAP engineering to verify before publication. Not indexed by search engines.

Documentation

Security overview

The controls that apply to REAP itself: identity, access, encryption, program and disclosure.

Controls

AreaControlStatus
Access to customer environmentsRead-only by default; PAM brokering (CyberArk (opens in a new tab)); scoped write for approved runbooks; revocableStated
Customer identitySSO (SAML/OIDC); RBAC. Role set and separation of approver and executor: Stated
REAP staff accessLeast privilege, reviewed quarterly, phishing-resistant MFAStated
EncryptionTLS 1.2+ in transit; AES-256 at rest with cloud KMSStated
AuditQueries, conclusions, approvals and actions logged; export formatsStated
ProgramSOC 2 (opens in a new tab) Type II in process; ISO 27001 (opens in a new tab) / NIST CSF (opens in a new tab) aligned, not certified; annual third-party penetration testStated · dates
PrivacyGDPR (opens in a new tab), UK GDPR (opens in a new tab), CCPA (opens in a new tab)/CPRA program; DPA availableStated
Disclosuresecurity@reapnet.ai; /.well-known/security.txt; acknowledgment within two business daysStated

AI-specific controls

  • Recommend-only by default; approved runbooks execute behind a confirmation; per-action autonomy settings are in development.
  • Pre-execution change impact analysis before a change runs; runbook guardrails blast-radius limits and where they are enforced.
  • Consequential actions require approval regardless of what the model concludes; retrieved-content handling is described in the security packet.
  • Evidence steps and tool calls recorded for every investigation; engineers score conclusions in a pilot.
  • Credentials revocable by you at any time.

The security packet

  • Data-flow diagram · connector details · credential model · data classes and retention · model options and training policy · subprocessors · pre-filled questionnaire (SIG (opens in a new tab)/CAIQ) · program status.
  • Request it from the Trust Center; sent under NDA, with any item still being finalized marked as such.

Last reviewed: October 7, 2026 (draft) · Owner: solutions engineering · Corrections: security@reapnet.ai