Security and trust
Rivermark is Revenue Outcome Governance for HubSpot. This page lists controls that exist in the product repository. It does not claim SOC 2, ISO 27001, HIPAA, GDPR certification, or a completed penetration test.
Production currently has unresolved operations work: a malformed TOKEN_ENCRYPTION_KEY and unapplied repository migrations. Those blockers are not marked resolved here.
Controls that exist
- HubSpot OAuth credentials are encrypted before durable storage (AES-256-GCM). New writes do not keep plaintext tokens.
- Organization isolation is enforced on the server. Frontend hiding is not authorization.
- Named-user role-based access (OWNER, ADMIN, MANAGER, REVIEWER, VIEWER).
- Governance audit events are append-only in application code. The API cannot update or delete them.
- Verification, outcomes, comparisons, and value estimates are deterministic engines. AI cannot authorize, verify, or upgrade claim strength.
- Review mutations require a named session with review permission. A capability URL is not write authority.
- Data deletion runs as a dry-run preview first, then an irreversible erase of the HubSpot mirror and stored credentials, confirmed with a one-time token and phrase.
- Operator-run retention purge workers with an allowlist of purgeable tables; each pass is audited.
- HTTP security headers (CSP, nosniff, frame deny, Referrer-Policy, Permissions-Policy; HSTS in production).
Controls that do not exist
- SSO / SAML / OIDC
- SCIM
- SOC 2, ISO 27001, HIPAA, or GDPR certification
- 24/7 SOC or committed incident SLA
- Proven hosted backup/restore RPO/RTO (undecided)
- Deletion of audit history, governance decisions, or measurement evidence (retained by design; the deletion preview names what is kept and why)
Report a vulnerability
Email security@rivermark.ai. Do not include live secrets in public issues.
← Back to Rivermark