Documentation
Security overview
The controls that apply to REAP itself: identity, access, encryption, program and disclosure.
Controls
| Area | Control | Status |
|---|---|---|
| Access to customer environments | Read-only by default; PAM brokering (CyberArk (opens in a new tab)); scoped write for approved runbooks; revocable | Stated |
| Customer identity | SSO (SAML/OIDC); RBAC. Role set and separation of approver and executor: | Stated |
| REAP staff access | Least privilege, reviewed quarterly, phishing-resistant MFA | Stated |
| Encryption | TLS 1.2+ in transit; AES-256 at rest with cloud KMS | Stated |
| Audit | Queries, conclusions, approvals and actions logged; export formats | Stated |
| Program | SOC 2 (opens in a new tab) Type II in process; ISO 27001 (opens in a new tab) / NIST CSF (opens in a new tab) aligned, not certified; annual third-party penetration test | Stated · dates |
| Privacy | GDPR (opens in a new tab), UK GDPR (opens in a new tab), CCPA (opens in a new tab)/CPRA program; DPA available | Stated |
| Disclosure | security@reapnet.ai; /.well-known/security.txt; acknowledgment within two business days | Stated |
AI-specific controls
- Recommend-only by default; approved runbooks execute behind a confirmation; per-action autonomy settings are in development.
- Pre-execution change impact analysis before a change runs; runbook guardrails blast-radius limits and where they are enforced.
- Consequential actions require approval regardless of what the model concludes; retrieved-content handling is described in the security packet.
- Evidence steps and tool calls recorded for every investigation; engineers score conclusions in a pilot.
- Credentials revocable by you at any time.
The security packet
- Data-flow diagram · connector details · credential model · data classes and retention · model options and training policy · subprocessors · pre-filled questionnaire (SIG (opens in a new tab)/CAIQ) · program status.
- Request it from the Trust Center; sent under NDA, with any item still being finalized marked as such.
Last reviewed: October 7, 2026 (draft) · Owner: solutions engineering · Corrections: security@reapnet.ai