Trust Center

Security you can verify, not a badge to admire

Each statement on this page is labeled: enforced by the architecture, a documented control, or in progress. Where a detail belongs in a controlled document, we say so and send it under NDA.

Request the security packet Contact security

Read-only by defaultAutonomy is a dial you holdRevocable read-only credentials; CyberArk brokeringSaaS today; your cloud or on-prem by arrangement

Compliance Risk profile Security controls AI & agent governance Deployment models Document room Data privacy Operations Disclosure Accessibility

Running a security review? Start here.

Accept the mutual NDA online, two minutes, countersigned copy by email.
Request the security packet and name the questionnaire your process uses (SIG (opens in a new tab), CAIQ (opens in a new tab) or internal); we return it filled, with any item still being finalized marked as such.
Book thirty minutes with our engineering lead for architecture, tenancy, keys and the audit trail.
Scope the pilot to limit what you need to trust: read-only credentials you issue and can revoke at any time, connectors that open an outbound TLS tunnel with no inbound firewall rule to REAP, no write access outside runbooks you approve, and evaluation data deleted at the end on request. A read-only pilot can be approved on the packet while production waits for the SOC 2 (opens in a new tab) Type II report; your process decides.

Questions at any point: security@reapnet.ai

Compliance posture

A roadmap, honestly labeled, is the rigorous signal, not the gap

Status as of September 27, 2026. Three principles: controls before badges, evidence by design, earned before claimed. Where a status is “in progress”, the security packet states the current timeline.

In process attestation in processAligned controls mapped, not certifiedReference used as design guidance, not assessedPrograms in place operating, not certifiableBy design out of scope or satisfied by architectureScoping settled per customer in the security reviewNot assessed / Not pursued stated plainly

Framework	Status	What it means at REAP
SOC 2 (opens in a new tab) Type II	In process	Attestation in process; report available upon request, under NDA. The current status, scope and timeline are stated in the security packet.
ISO/IEC 27001 (opens in a new tab):2022	Aligned	Controls aligned to ISO/IEC 27001 (opens in a new tab); not certified. Certification intent and timing are stated in the security packet.
NIST CSF 2.0 (opens in a new tab)	Aligned	Controls aligned across Govern, Identify, Protect, Detect, Respond and Recover; not certified. The mapping is described in the security packet.
NIST AI RMF (opens in a new tab) 1.0	Reference	Used as design guidance for the model and agent lifecycle. The operative controls today are read-only defaults, approval-gated runbooks and evidence traceability.
NIST SP 800-218 (opens in a new tab) (SSDF)	Reference	Secure development practices aligned to the SSDF; the practices in place are listed with evidence in the security packet.
OWASP (opens in a new tab) ASVS and OWASP Top 10 for LLM Applications	Reference	Used in design and testing for application and LLM-specific risks: prompt injection, insecure output handling, excessive agency. Approval gates bound what any model output can change.
ISO/IEC 42001 (opens in a new tab):2023	Under evaluation	Under evaluation as the management-system standard for REAP’s agent harness; no assessment has been performed.
CSA STAR (opens in a new tab) / CAIQ (opens in a new tab) v4	On request	We complete the CAIQ (opens in a new tab), SIG (opens in a new tab) or your own questionnaire for your review; a STAR listing is under consideration.
GDPR (opens in a new tab) and UK GDPR (opens in a new tab)	Programs in place	Lawful basis, data minimization and data-subject rights; a data processing agreement is available.
CCPA (opens in a new tab) / CPRA (opens in a new tab)	Programs in place	Consumer rights honored through the privacy workflow; no sale or sharing of personal information.
HIPAA (opens in a new tab)	Scoping	REAP needs no clinical data and collects none by design. Where a covered entity determines that a business associate agreement is required, REAP will review one with counsel; PHI in ticket text is settled in the security review.
PCI DSS (opens in a new tab) 4.0	By design	No cardholder data is collected and REAP does not sit in the cardholder data environment; we provide a scoping statement for your QSA on request.
NERC CIP (opens in a new tab)	Not assessed	Utilities with BES Cyber System scope should discuss the deployment boundary, data classes and CIP-013 supply-chain questions with REAP before an evaluation; utility pilots are scoped to non-OT networks in REAP Cloud.
FedRAMP (opens in a new tab)	Not pursued	Public-sector organizations would deploy REAP in their own cloud tenancy or on-premises, by arrangement, rather than in REAP Cloud.

Risk profile

At a glance

The eight facts a vendor-risk reviewer records first.

Hosting

REAP Cloud runs on Amazon Web Services (opens in a new tab) in U.S. regions with multi-availability-zone failover. By arrangement, REAP can run in your AWS (opens in a new tab), Azure (opens in a new tab) or GCP (opens in a new tab) account or in your data center; air-gapped operation, including model hosting and update packaging, is scoped per customer and is not yet a standard offering.

Data residency

REAP Cloud: U.S. regions today. Customer Cloud (by arrangement): the region you choose. Customer On-Prem (by arrangement): data stays in your facility. No cross-geography movement in normal operation.

Criticality

REAP is not in the data path of your network. Where CyberArk (opens in a new tab) brokers device credentials, REAP holds none standing; otherwise read-only credentials are held encrypted as described in the security packet. If REAP is unavailable, your network keeps running; investigations pause, nothing else does. At the end of an evaluation or subscription your data is deleted on request, and the findings REAP wrote to your tickets stay in your ITSM.

Data access level

REAP collects device configurations, command output, topology, telemetry, ticket metadata, and flow records (NetFlow or IPFIX) where you configure them. It does not inspect traffic payloads and does not capture traffic continuously; on-demand packet captures run only when you ask. Those captures are kept with that investigation and follow the retention terms. No clinical or cardholder data by design. How secrets in collected configurations are handled before evidence reaches a model is described in the security packet.

Subprocessor dependence

Minimal: cloud hosting, the managed model endpoint, email delivery and support tooling. The versioned list with purpose and location ships with the DPA.

Cryptographic posture

TLS 1.2 or higher in transit; AES-256 at rest with keys in a cloud KMS. In a customer-hosted deployment, key management in your own account is agreed per deployment.

Agent action posture

Read-only by default. Writes happen only through runbooks you approved, each behind a confirmation and recorded with the device output. Any runbook can be halted and its credentials revoked at any time. A per-action autonomy control and automatic rollback are in development.

AI model posture

Customer data is not used to train models without your written consent. Inference runs on REAP-managed endpoints today, using a curated, validated set of commercial models; the provider is named in the security packet. Customer-controlled endpoints for customer-hosted deployments are available on request. Consequential actions require human approval regardless of what a model concludes.

Security controls

The evidence: control families mapped to enforcement

Each family names the control, where it is enforced and the frameworks it maps to. Detail, ownership and test results are in the packet.

Identity & access

Read-only, least-privilege credentials by default; write access only for approved runbooks
Device credentials brokered from CyberArk (opens in a new tab) at time of use where you run it; revocable by you at any time
Customer SSO (SAML/OIDC); role-based access; tenant isolation enforced at the application layer
Internal access: phishing-resistant MFA, least privilege, quarterly access reviews

NIST CSF (opens in a new tab) PR.AA · ISO 27001 (opens in a new tab) A.5.15–A.5.18 · SOC 2 (opens in a new tab) CC6

Encryption & key management

TLS 1.2+ for every connection, including connector-to-platform traffic
AES-256 at rest; keys in a cloud KMS
Handling of secrets in collected configurations described in the security packet
Key management in customer-hosted deployments agreed per deployment

NIST CSF (opens in a new tab) PR.DS · ISO 27001 (opens in a new tab) A.8.24 · SOC 2 (opens in a new tab) CC6.1, CC6.7

Application & agent security

Secure development practices aligned to NIST SP 800-218 (opens in a new tab); the practices in place are listed with evidence in the security packet
Approval gate before any write: a model cannot change a device outside an approved runbook
Runbooks validated when compiled and run with a full execution record
Further harness controls (command allow-lists, protected devices, blast-radius limits, injection regression tests) described with their implementation status in the security packet

NIST (opens in a new tab) SSDF · OWASP (opens in a new tab) ASVS · OWASP LLM Top 10 · SOC 2 (opens in a new tab) CC8

Infrastructure & network

Tenant isolation enforced at the application layer in REAP Cloud
Connector cluster inside your network; outbound TLS tunnel; ports and encryption stated in the packet
Customer-hosted deployments: your network controls apply; REAP supplies the reference architecture

NIST CSF (opens in a new tab) PR.IR · ISO 27001 (opens in a new tab) A.8.20–A.8.22 · CIS Controls (opens in a new tab) 12

Monitoring, logging & detection

Runbook executions and approvals recorded with who, what, when and the device output
Audit log retained and available for export (formats in the security packet)
Platform telemetry and security events monitored with alerting

NIST CSF (opens in a new tab) DE.CM · ISO 27001 (opens in a new tab) A.8.15–A.8.16 · SOC 2 (opens in a new tab) CC7

Vulnerability & threat management

Dependency and container scanning with risk-based remediation
Annual penetration test by an independent third party; summary under NDA
Coordinated vulnerability disclosure with safe harbor (below)
Agent-specific risks reviewed in the threat model

NIST CSF (opens in a new tab) ID.RA · ISO 27001 (opens in a new tab) A.8.8 · SOC 2 (opens in a new tab) CC7.1

Business continuity & recovery

REAP Cloud: multi-availability-zone deployment with encrypted backups
Recovery objectives stated in the subscription agreement
Customer-hosted deployments: backup and restore procedures documented for your operations team
A REAP outage does not affect the network it observes

NIST CSF (opens in a new tab) RC · ISO 27001 (opens in a new tab) A.5.29–A.5.30 · SOC 2 (opens in a new tab) A1

Risk, vendor & personnel

Risk assessment and treatment reviewed at least annually
Subprocessor due diligence and contractual flow-down; changes notified in advance
Background screening, confidentiality agreements and security training for all staff
Incident response plan with customer notification per contract and regulation

NIST CSF (opens in a new tab) GV · ISO 27001 (opens in a new tab) A.5, A.6 · SOC 2 (opens in a new tab) CC1–CC3, CC9

AI and agent governance

Responsible by design: assume an agent can be manipulated, and design accordingly

REAP’s agents investigate networks. Below is what is in place today, with what is in development labeled as such: the same controls the buyer’s guide tells you to demand from any vendor.

Autonomy, approvals and limits

Recommend by default: REAP explains and recommends; it executes only runbooks you approved, behind a confirmation. Autonomy expands only as you approve it, action type by action type; a per-action autonomy control is in development.
Pre-execution assessment of proposed changes against redundancy, reachability and security policy, with the reasons shown.
Bounded by design: a model cannot change a device outside an approved runbook. Further harness controls (command allow-lists, protected devices, blast-radius limits) are described with their status in the security packet.
Stop and revoke: any runbook can be halted and its credentials revoked at any time; reverse steps are authored into runbooks where the change is reversible (automatic rollback: in development).
Audit: runbook executions and approvals are logged with the device output; the log is available for export.

Model lifecycle and data

Curated models: REAP uses a curated, validated set of commercial models; the provider is named in the security packet.
Training policy: customer data is not used to train models without your written consent; data-use terms are stated in the agreement.
Endpoint options: REAP-managed today; customer-controlled endpoints for customer-hosted deployments on request.
Retrieved content: configurations, tickets and documents are evidence for the investigation; consequential actions require human approval regardless of what a model concludes.
Explainability: evidence traceability is a measured quality metric (design target ≥ 90% of conclusions traceable); uncertainty is stated, never guessed.

NIST AI RMF (opens in a new tab) 1.0 and the OWASP (opens in a new tab) Top 10 for LLM Applications are used as design guidance; ISO/IEC 42001 (opens in a new tab) is under evaluation.

Deployment models

SaaS today; Customer Cloud and Customer On-Prem by arrangement

Choose the boundary your regulator, your CISO and your network team can all sign. REAP Cloud runs today; the other two models are scoped per customer. The controls above apply in every model; what changes is where the platform and the data live.

	REAP Cloud (SaaS)	Customer Cloud	Customer On-Prem
Availability	Available today	By arrangement	By arrangement
Where the platform runs	REAP-operated tenancy on AWS (opens in a new tab) (U.S. regions, multi-AZ)	Your AWS (opens in a new tab), Azure (opens in a new tab) or GCP (opens in a new tab) account, region of your choice	Your data center or private cloud
Where your data rests	REAP Cloud, isolated per tenant	Your cloud account	Your facility
Who operates the platform	REAP	REAP, with your cloud team (shared responsibility)	Your operations team with REAP support
Model endpoints	REAP-managed	REAP-managed, or your endpoint in your cloud (confirmed per deployment)	Confirmed per deployment (local models or an endpoint you control)
Connector cluster	In your network; outbound to REAP Cloud over TLS	In your network; traffic stays in your cloud boundary	In your network
Identity	Your SSO (SAML/OIDC)	Your SSO	Your SSO or directory
Update cadence	Continuous, with release notes	Scheduled with your change window	Scheduled; offline packaging confirmed per customer
Typical fit	Enterprises and MSPs that accept SaaS with a DPA (SOC 2 (opens in a new tab) Type II in process)	Enterprises that require the platform and its data in their own cloud account	Estates that cannot use cloud services; OT and air-gap requirements scoped per customer

Document room

Due-diligence evidence

Public items are linked. NDA-gated items are released to named reviewers after access is requested; requests are acknowledged within one business day.

Document	Category	Access	Action
Security and architecture overview	Overview	Public	This page and Architecture & deployment
Security packet: data-flow diagram, connectors, credential model, data classes and retention, model options, program status	Packet	NDA	Request
SOC 2 (opens in a new tab) Type II report	Attestation	In process	Request (NDA)
Penetration test · executive summary	Report	NDA	Request
Questionnaire answers (CAIQ (opens in a new tab), SIG (opens in a new tab) or your own)	Questionnaire	NDA	Request
Information security policy set (access control, acceptable use, incident response, vulnerability management, change management)	Policy	NDA	Request
Business continuity and disaster recovery summary	Plan	NDA	Request
Network and data-flow diagrams per deployment model	Diagram	NDA	Request
Software bill of materials (SBOM)	Artifact	NDA	Request
Subprocessor list	Register	On request	Request
Data processing agreement (DPA)	Legal	On request	Request
Model and data-use terms (training policy, endpoint options, retention)	Legal	On request	Request
Certificate of cyber insurance	Legal	NDA	Request

Access process. Sign the mutual NDA online (or send yours), then request the packet with your name, company and review purpose. Reviewers receive the documents from a named person at REAP, not from an automated portal.

Data privacy

Your data rights

REAP honors the rights granted under GDPR (opens in a new tab), UK GDPR (opens in a new tab) and CCPA (opens in a new tab)/CPRA for the personal information it holds about website visitors, prospects and customer users: the right of access, the right to correct, the right to delete (subject to legal retention), the right to know what is processed and with whom it is shared, and the right to opt out of sale or sharing: REAP does not sell personal information and does not use it for advertising.

Requests: privacy@reapnet.ai. The privacy statement covers this website, including HubSpot: when that integration is enabled, details sent through this website’s forms also go to REAP’s HubSpot CRM, which HubSpot operates for REAP as a processor. The DPA, retention schedule and records of processing cover the REAP service and are available on request.

What the service processes

Configurations, command output, topology, telemetry, ticket metadata and, where you configure them, flow records (NetFlow or IPFIX) about network devices, not people.
Names and work email addresses of customer users for authentication and audit.
No traffic-payload inspection and no continuous traffic capture; on-demand packet captures only when you ask.
No clinical data and no cardholder data, by design.

Operations

Availability and resilience

Not in path

REAP observes the network; it does not carry its traffic. An outage of REAP does not affect your network.

Architecture

Multi-AZ

REAP Cloud runs across availability zones with encrypted, region-redundant backups.

REAP Cloud

Stated in the agreement

Availability commitment and recovery objectives (RPO/RTO) for REAP Cloud.

Subscription agreement

Notified

Security incidents handled under a documented, tested incident response plan; customers notified per contract and regulation.

IR plan

A public status page with uptime history and incident notifications is planned for launch; until then design partners and pilot customers receive maintenance and incident notices by email.

Coordinated disclosure

Report a vulnerability

We welcome good-faith security research. Report a suspected vulnerability in REAP software or this website to security@reapnet.ai; a PGP key is available on request. We acknowledge reports within two business days, triage within five, and keep you informed through remediation; we ask for reasonable time to fix before public disclosure.

Safe harbor

Research conducted in good faith and within this policy is authorized; we will not pursue legal action or law-enforcement referral for it. Do not access, modify or destroy data that is not yours, degrade service, or test production systems you are not authorized to use; stop and report as soon as a vulnerability is confirmed. Our security.txt carries the same contact.

Accessibility

This website

This website is designed to meet WCAG (opens in a new tab) 2.2 Level AA (keyboard navigation, visible focus, semantic structure, color contrast, reduced-motion support and text that reflows to phone widths) and is checked against it before each release. If something falls short for you, tell us at privacy@reapnet.ai and we will fix it or provide the content another way.

Roadmap

Targets, with dates confirmed in the security packet

When	Milestone	Evidence you will see
Next	SOC 2 (opens in a new tab) Type II report	In process; available upon request, under NDA, in the document room
Target Q4 2026	Public status page; published subprocessor page	Links on this page
Target H1 2027	ISO/IEC 27001 (opens in a new tab) certification audit	Certificate
Under evaluation	ISO/IEC 42001 (opens in a new tab) for the agent harness; CSA STAR (opens in a new tab) listing	Decision stated in the packet

Get the written answers.

The security packet: data-flow diagram, connector details, credential model, data classes and retention, model options, subprocessors, questionnaire answers and program status.

Request the security packet Sign the mutual NDA