Security

RI Platform is designed around secure-by-design principles that help protect customer workspaces, data, integrations, credentials, and API access.

Security controls are built into the platform architecture rather than relying only on user interface behaviour. Backend services remain the source of truth for sensitive operations such as authentication, authorisation, workspace access, API key permissions, upload validation, datasource handling, and billing-sensitive actions.

ISO 27001-aligned practices

Reliable Insights is committed to maintaining high standards of information security across our organisation, products, and services. We are implementing an Information Security Management System (ISMS) aligned with the principles and requirements of ISO/IEC 27001 and intend to pursue independent certification as our information security programme matures.

Our information security programme follows a risk-based approach and includes governance, policies, technical and organisational controls, employee awareness, and continual improvement to protect the confidentiality, integrity, and availability of information. Although not currently ISO/IEC 27001 certified, we are committed to adopting recognised information security best practices and continually strengthening our ISMS.

Secure by design

Reliable Insights uses several layers of protection across RI Platform.

• Secure authentication - Users must be authenticated before accessing protected areas of the platform.
• Workspace separation - Customer data and resources are scoped to the workspace where they were created.
• Role-based control - Administrative actions are protected by workspace roles such as Owner and Admin.
• Least-privilege API access - API keys can be scoped so integrations only receive the permissions they need.
• Controlled data entry - Uploaded data, datasource configuration, and API-driven inputs are validated before use.
• Sensitive credential handling - Datasource credentials and API keys are handled differently from ordinary display data.
• Traceability - Selected security-relevant events are recorded to support review and investigation.

Backend-enforced controls

The user interface provides guided workflows, safer defaults, and early validation, but backend services enforce security-sensitive decisions.

This means access control does not rely only on whether a page, button, or menu item is visible in the interface. Backend services check whether the authenticated user, workspace, role, API key, or request is allowed to perform the requested action.

This helps protect customer resources from direct endpoint access, modified URLs, bypassed interface flows, or unauthorised automated requests.

Workspace boundaries

Workspaces are the main organisational and security boundary within RI Platform.

Workspace-scoped resources can include:

• Studio datasets and experiments.
• Pipeline datasources, feeds, deployments, and results.
• RI Connect API keys and API-created resources.
• Workspace subscription and usage information.
• Workspace member settings.

Data and resources are associated with the workspace where they were created. Users must have access to the relevant workspace before they can view, use, or manage its resources.

Customer datasets are stored separately from one another. Customer datasets are logically separated by workspace and customer context, with backend controls enforcing access boundaries. This separation supports workspace-level access control, customer data isolation, and secure handling of customer-specific modelling and forecasting workflows.

For more information, see RBAC & Permissions.

Data handling and upload controls

RI Platform handles uploaded data through controlled, workspace-scoped workflows.

When customers upload datasets or introduce data through Pipeline and RI Connect workflows, that data is associated with the workspace where it was added. This helps keep customer data organised, access-controlled, and separated by workspace context.

Before uploaded data is used in modelling or forecasting workflows, RI Platform validates that it meets expected structure and format requirements. Validation helps ensure that data can be processed safely and predictably before it is registered for use.

Validation may include checks for:

• Supported file format.
• File size or row limits.
• Readable structure.
• Valid timestamp data.
• Usable numeric values.
• Required columns.
• Consistent data shape.

These controls help reduce the risk of unsupported or malformed files entering modelling workflows.

API key security

API keys allow external applications, scripts, and automated workflows to authenticate with the Reliable Insights Platform API.

API keys are created within a workspace and are intended to access resources belonging to that workspace. They can be scoped so integrations only receive the permissions required for their workflow.

Customers can use API key controls to:

• Create separate keys for separate integrations.
• Limit each key to the minimum required scopes.
• Rotate keys when a replacement is required.
• Revoke keys that are no longer needed.
• Review key usage information where available.

API keys should be treated like passwords or other sensitive credentials. They should be stored securely and never committed to source control, shared in screenshots, or hardcoded into application code.

For more information, see RBAC & Permissions.

Datasource and credential handling

Datasources allow RI Platform to connect to external systems so that data can be used in Pipeline workflows.

Because datasources may include sensitive connection details, RI Platform handles datasource configuration carefully. Sensitive fields are treated differently from non-sensitive metadata, and backend validation is used to control how outbound datasource connections are configured.

Datasource security controls include:

• Separating sensitive credential fields from non-sensitive configuration.
• Encrypting sensitive datasource credential values before storage.
• Keeping datasource access within the relevant workspace context.
• Supporting connection testing before scheduled pulls are used.
• Reducing unsafe datasource configuration patterns, such as embedded credentials in URLs.

Customers should use dedicated integration credentials where possible, apply least privilege to external datasource accounts, and rotate external credentials according to their internal policies.

For more information, see Networking.

Billing and payment boundaries

Billing and payment operations are handled through defined product flows, authenticated user context, workspace-level checks, and Stripe payment components.

Reliable Insights uses Stripe payment components for card entry and payment setup workflows. This means payment card details are entered through Stripe-supported payment interfaces rather than being handled as ordinary form data inside the RI Platform application.

Billing-sensitive actions are tied to authenticated user and workspace context. Backend checks help ensure that payment methods and billing actions are associated with the correct user, workspace, or billing setup.

Customers should avoid sending payment card details through support tickets, chat messages, screenshots, emails, or other non-payment workflows.

Monitoring and traceability

Reliable Insights records selected security-relevant events to support traceability, operational review, and investigation of important platform activity.

These may include events related to:

• API key creation.
• API key rotation.
• API key revocation.
• API key authentication success or failure.
• Rejected use of expired or revoked keys.
• Workspace privilege changes.
• Workspace-level access or permission activity.

Auditability helps customers and Reliable Insights understand when important security-related actions occurred, which workspace they related to, and which user or credential was involved where that information is available.

For more information, see Monitoring & Logging.

Customer responsibilities

Reliable Insights provides platform-level controls, but customers also play an important role in secure operation.

Customers should:

• Use strong passwords and enable two-factor authentication where available.
• Only invite trusted users to workspaces.
• Assign workspace roles carefully.
• Use the minimum permissions required for each user or integration.
• Store API keys and datasource credentials securely.
• Rotate or revoke credentials that may have been exposed.
• Use separate workspaces for separate teams, customers, or workflows.
• Avoid uploading unnecessary sensitive data.
• Review datasource, integration, and API key activity regularly.