Ryva Trust Center
Security and trust
Last updated: July 26, 2026
1. Our current security posture
Ryva is built with managed Firebase services, including Firestore, Cloud Functions, and Cloud Storage. We use Firebase Authentication and workspace membership checks to support authenticated, workspace-scoped access to product data.
This page describes only controls and practices that Ryva has verified against its current implementation. It is updated as the service and its evidence change.
2. Access boundaries
- Workspace resources are scoped to a workspace, and access checks use workspace membership.
- Sensitive operations are handled through server-side Firebase Functions rather than direct client-side privileged writes.
- Storage and database rules are designed to enforce workspace membership for protected data.
3. Verification and compliance status
Ryva does not currently represent itself as SOC 2 Type II certified, as able to sign a Business Associate Agreement, or as independently attested for a specific compliance framework. We will publish those statements only after the relevant controls, agreements, and verification are in place.
4. Data and AI transparency
Customer data and model training
Ryva does not publish a training-use claim without provider-specific, verified terms.
Model providers
Model-provider details are not yet published as a public commitment.
Retention and deletion
Current retention and deletion commitments are governed by the Privacy Policy; expanded operational details will be published when verified.
Encryption, backups, and regions
Ryva uses managed Firebase infrastructure. Specific encryption, backup, and data-region commitments are not publicly asserted until verified.
Subprocessors and incident response
A public subprocessor list and incident-response commitment are not yet published.
Enterprise options
Enterprise compliance and contractual options are discussed only after the applicable controls and agreements are verified.
5. Responsible disclosure
If you discover a security vulnerability in the Service, please report it responsibly to hello@ryva.io. Please include a description of the issue, steps to reproduce, and your contact information. We will review the report and work with you to understand and remediate the issue.
We ask that you do not publicly disclose the vulnerability until we have had a reasonable opportunity to address it. We will not take legal action against researchers who follow these guidelines in good faith.
6. Contact
Security questions or vulnerability reports: hello@ryva.io
General privacy questions: see our Privacy Policy.