Security & Infrastructure

1. Execution safeguards

Cleaning runs on Rightrow-managed infrastructure. Deterministic transformations are generated server-side. When an optional model-assisted step is used for an ambiguous mapping, its output is validated before execution and runs in a restricted environment with resource limits. We do not execute arbitrary Python supplied by users.

Isolation is process-level; we do not represent it as hardware-VM isolation. Buyers who need the detailed control set can request it through security@getrightrow.com.

2. Access control

Web sessions are authenticated with our identity provider and verified server-side. Extension and API keys are accepted only when they resolve to an active record. Plan entitlements are enforced server-side and default to the free tier when no paid entitlement is present.

3. Data handling and retention

Uploaded and derived files are temporary. They are deleted within 60 minutes by default; the operator may configure a different window. If the deployment uses object storage, the operator's bucket lifecycle policy governs retention.

We do not train models on customer datasets and we do not sell them. The optional model-assisted step receives only a small, redacted sample when deterministic rules cannot resolve a mapping.

4. Transport and rate limits

Client, extension, and API traffic uses HTTPS. Public endpoints are rate-limited and request bodies are size-capped.

5. Reporting a vulnerability

Send security reports to security@getrightrow.com with reproduction steps. Do not include live customer data in a report.