Security and Trust at the Foundation of Revolte
Understand how Revolte protects your data, maintains compliance, and operates with transparency.
Our Commitment
Revolte connects to your engineering tools-and that means your most sensitive data passes through our platform. We take that responsibility seriously.
Security isn’t a feature we bolt on. It’s embedded in how we build, how we operate, and how we treat your data. This page explains our practices across three dimensions: how we handle your data, how we stay compliant, and how you stay in control.
How We Handle Your Data
Data We Access
When you integrate Revolte with your tools-GitHub, Jira, Figma, or any others-we access specific data needed for core functionality. We never request broad, undefined access. Every integration has specific, documented scopes.
Data We Store
We distinguish between data we read (access but don’t store) and data we sync (store for analysis and dashboards).
- Read only (not stored on Revolte servers): Real-time queries to your tools when you request a dashboard or report.
- Sync and store (encrypted at rest): Commit metadata, issue history, design milestones-the signal we analyze to map your product lifecycle.
Data we store is encrypted with AES-256 at rest and TLS 1.2+ in transit. Encryption keys are stored separately in a secure vault; Revolte staff do not have direct access to decryption keys.
Data Retention & Deletion
- Automatic cleanup: Data older than your workspace retention policy is automatically purged.
- User-initiated deletion: You can delete any integration anytime, immediately revoking Revolte’s access to that source.
- Workspace deletion: When you delete a Revolte workspace, all associated data is permanently deleted within 30 days.
- Export anytime: You can export all your data in standard formats (JSON, CSV) without restrictions or penalties.
We Do Not Share Your Data
- No third-party access: We don’t sell, license, or share your data with third parties.
- No training data: Your data is never used to train Revolte’s models or any other AI systems.
- Legal requests only: We share data only when required by valid legal process (court order, warrant). We notify you when legally permitted to do so.
Compliance and Certifications
Current Certifications
- SOC 2 Type II: [Active] - Audit of Revolte’s security controls, availability, and data confidentiality.
- ISO 27001: [Active] - Information security management system certification.
- GDPR: [Active] - EU data protection compliance, including Data Processing Agreement (DPA).
- CCPA/CPRA: [Active] - California privacy rights and data subject requests.
Note on compliance: We list only active certifications. If a certification is in progress, we note it openly rather than claiming completion. Check back for updates; all changes are reflected here.
Audit & Assessment History
We undergo regular third-party security audits. Recent audit summaries and pen-test results are available to enterprise customers under NDA. Contact support@revolte.ai to request.
Your Control: Audit Logs, Permissions, and Revoking Access
Revoke Access Anytime
Revoking Revolte’s access to any tool is instant:
- Go to Settings > Integrations
- Click the integration and select “Revoke Access”
- Revolte can no longer read from that tool. Any dashboards depending on that data will show “data unavailable.”
You can re-authenticate anytime without data loss.
Data Security in Practice
Encryption Standards
- In Transit - TLS 1.2+: All API calls to your tools and Revolte’s platform use encrypted HTTPS.
- At Rest - AES-256: Database encryption for all stored data.
- Key Management - Hardware Security Module: Encryption keys are stored separately in a secured vault.
Access Controls
- Role-based access (RBAC): Workspace admins, team leads, and members have different permissions. Only admins can manage integrations or view audit logs.
- Least privilege: Revolte services run with minimal required permissions. Our CI/CD pipeline, databases, and monitoring systems operate under separate, audited credentials.
- No backdoors: Revolte staff cannot access customer data without explicit audit trails. All admin access is logged and reviewed.
Incident Response
If we detect unauthorized access or a potential breach:
- We immediately isolate affected systems.
- We notify affected customers within 24 hours.
- We provide a detailed incident report including what was accessed, when, and our remediation steps.
Report a security concern: support@revolte.ai
Compliance by Region
GDPR (EU/UK)
- Data Processing Agreement (DPA) included with all Enterprise plans.
- Right to access, correct, and delete your data anytime.
- Data residency options for EU customers (data stored in EU data centers).
- Sub-processor disclosures available on request.
CCPA/CPRA (California)
- You have the right to know what data we collect, delete it, and opt out of certain uses.
- Privacy notice and instructions for data subject requests are available on request.
- No “sale” of personal information as defined by CCPA.
Responsible Disclosure & Security Research
Found a security vulnerability? We appreciate responsible disclosure.
Do not open a public GitHub issue or social media post. Instead:
- Email support@revolte.ai with details (including proof-of-concept if safe to share).
- Allow us 30 days to investigate and patch before public disclosure.
- We’ll acknowledge your report and credit you in our security updates (if you wish).
Frequently Asked Questions
Q: What happens if Revolte is breached?
A: We have incident response protocols in place. We notify affected customers within 24 hours, provide a detailed incident report, and document remediation steps. We maintain cyber liability insurance. Enterprise customers can request our policy details.
Q: Can Revolte read my source code?
A: Revolte reads commit metadata (messages, authors, timestamps, branch names) but not the actual code diff. We don’t have access to your repository contents. If you integrate Figma, we read design files and assets, not your source.
Q: Do you comply with SOC 2?
A: Yes. We’re actively pursuing SOC 2 Type II certification; check back for updates.
Q: Can I use Revolte offline?
A: Revolte is a cloud platform and requires internet connectivity. We do not offer on-premise or air-gapped deployments at this time. Contact sales if you have data residency requirements or offline use cases.
Q: Can I request a penetration test or security audit?
A: Yes. Enterprise customers can request recent audit summaries and pen-test reports under NDA. Contact support@revolte.ai.
Questions or Concerns?
Contact: support@revolte.ai
