Data protection
Each RushDB Cloud project is its own engine tenant with its own key prefix. Every query is bound to the tenant before data is read, so it can never read or write another project’s records.
Security
Security and privacy for RushDB customers.
RushDB is a database for AI, available as an open-source engine you run yourself and as the managed RushDB Cloud. This page summarizes the controls, privacy practices, and disclosure process for both.
Current posture
RushDB documents its security controls, privacy practices, subprocessors, and responsible disclosure channel for customer review.
Security contactAvailable
GDPR supportAvailable
Formal audit reportNot published
Operational controls.
RushDB keeps the control surface focused on the systems that matter for customer data: storage, transport, access, backups, and operational review.
Encryption
RushDB uses encrypted transport for customer-facing services. Hosted infrastructure is operated with encryption controls appropriate for managed cloud services.
Access control
Access to hosted RushDB environments is limited to authorized operators and managed through role-based administrative workflows.
Backups
Hosted RushDB is operated with backup and recovery practices intended to protect service continuity and customer data durability.
API keys
Each API key belongs to one project and is either full-access (server-side only) or read-only, where every write returns 403.
Self-hosted engine
Signed releases with checksums and an SBOM. Cleartext PostgreSQL wire, gRPC, and Bolt listeners stay on loopback unless you explicitly allow otherwise; optional fail-closed tenants.
Privacy and GDPR
Customer data stays governed.
RushDB supports privacy review with published policies, customer data workflows, and documented processing boundaries.
Privacy Policy and Terms of Service are published for customers.
Data deletion and export workflows are supported for customer data.
A data processing addendum can be provided for customers who require one.
Current subprocessor details are shared during customer security review.
Compliance
Compliance status.
RushDB shares current certification and regulatory information so customers can evaluate the product against their procurement and risk requirements.
RushDB supports GDPR-aligned customer workflows, including data deletion, export, subprocessors, and data processing terms.
No SOC 2 report has been published. Security questionnaires and control documentation are handled through security review.
RushDB is not ISO 27001 certified. Control documentation can be discussed through security review.
RushDB is a database used by AI systems, not an AI model. It supports governance workflows in downstream systems, such as traceability, access control, deletion, and auditability.
Subprocessors and documents.
RushDB maintains customer-facing security and privacy materials for hosted service reviews. Current subprocessor details and data processing terms can be shared with customers as part of onboarding or procurement.
Responsible disclosure.
Security reports are welcome when submitted in a way that protects customer data and service availability.
- 1Send vulnerability reports to the security contact below.
- 2Include affected URLs, project context, reproduction steps, and potential impact.
- 3Do not access, modify, destroy, or exfiltrate customer data.
- 4Do not run denial-of-service tests or social engineering campaigns.
Security contact.
For vulnerability reports, security questionnaires, privacy reviews, or data processing requests, contact RushDB with the relevant project, company, and review context.