1. Tenant isolation
Rakita is multi-tenant by construction, not by convention. Every read and write of tenant-scoped data is filtered by organization, and every API request is separately checked against the caller’s role and capabilities. The two controls are independent: the capability check guards the endpoint, the query filter guards the data, and both must pass.
When an authorization check fails on a tenant-scoped resource we return 404, not 403 — a caller cannot use error codes to discover whether another organization’s resource exists.
2. Authentication
- Passwords are hashed with bcrypt. We never store or log a plaintext password.
- Passkeys (WebAuthn) are supported as a phishing-resistant alternative to passwords, with a short-lived, single-use challenge per sign-in.
- Password-reset and passkey-challenge tokens are HMAC-signed and time-limited, so a leaked link expires and cannot be forged.
- Single sign-on is available, with SAML on Enterprise plans. Rakita acts as the identity authority across the product suite, so access is granted and revoked in one place.
- Optional social sign-in with Google, Facebook or Apple returns only your email address and display name. Google sign-in tokens are discarded as soon as sign-in completes and are never stored.
3. Encryption and data handling
- All traffic to and between our services runs over HTTPS/TLS.
- Data at rest, including backups, is encrypted by the storage layer.
- Third-party credentials — OAuth refresh tokens for connected channels, marketplace and git integrations — are held server-side only and are never sent to the browser.
- Secrets are never placed in queue messages. Background jobs receive an opaque reference and resolve the secret at the point of use.
4. Hosting and residency
Your account record, conversation history, connector configuration and the search index built from your documents are hosted in Türkiye, with database backups in the same region. Backup snapshots are retained for 30 days and then overwritten.
The document files you upload are stored as objects in Amazon S3 in an EU region, encrypted at rest. Uploading a file is therefore an international transfer out of Türkiye.
Some sub-processors also operate outside Türkiye — model providers, transactional email and error monitoring among them. Each one, and the specific data it receives, is listed in the Privacy Policy.
5. AI and your data
We do not train AI models on your data, and our model providers are contractually prohibited from doing so. Content is sent to a model provider only to answer the request in front of it, and is not retained by us for training, benchmarking or evaluation.
Where a product classifies content automatically — for example flagging spam or harassment in Social Moderator — that classification is a single stateless call. Decisions that affect a person’s employment always require human review; see section 5 of the Terms.
6. Operational access
- Access to production systems is least-privilege and limited to the engineers who need it to operate the Service.
- We use error and performance monitoring (Sentry) to detect failures. Diagnostic reports can include an email address and account identifier, and are retained only as long as needed to fix the failure.
- Deployments are forward-only, with breaking schema changes split across releases so a rollback never strands data.
7. Reporting a vulnerability
If you believe you have found a security issue, email hello@rakita.io with enough detail to reproduce it. Please give us a reasonable window to fix the issue before disclosing it publicly. We will acknowledge your report, keep you updated, and we will not pursue action against good-faith research that avoids privacy violations, data destruction and service disruption.
8. Incident response
If a breach affects your personal data, we will notify affected account administrators without undue delay, and we will notify the relevant supervisory authority where the law requires it. The notice will describe what happened, what data was involved, what we have done, and what you should do.
9. Security questionnaires
Evaluating Rakita and need more detail than this page gives — a security questionnaire, a data processing agreement, or a sub-processor list for your records? Email hello@rakita.io and we will work through it with you.