Security
Last updated August 6, 2026
Rhodes holds some of the most sensitive documents a family has: operating agreements, tax filings, trust instruments, account statements. This page describes, plainly and without exaggeration, how that data is protected. Every statement here is verified against how the product is actually built before it is published.
Encryption
All traffic to and from Rhodes is encrypted in transit using TLS, and our domains are HSTS-preloaded so browsers refuse unencrypted connections. Data is encrypted at rest by our infrastructure providers (Supabase and AWS).
Per-organization isolation
Every organization’s data is isolated with database-level Row-Level Security policies on all organization-scoped tables, plus per-request organization checks in the application layer. One customer’s records are never visible to another.
Authentication
Sign-in is handled through Google OAuth — Rhodes never stores passwords. Multi-factor authentication (TOTP authenticator apps) is available, and step-up verification is required for sensitive actions inside the product.
Audit logging
Rhodes keeps an append-only audit log of activity in your organization. No user or application path can modify or delete audit entries; audit records are removed only when an organization is permanently deleted.
Backups
Databases are backed up nightly with encrypted backups, and backup restoration is tested. Residual copies in backups are purged within 90 days through scheduled rotation, consistent with our Privacy Policy.
Payments
Payments are processed on Stripe-hosted pages. Your card number is entered directly with Stripe and never touches Rhodes’ systems — there is no card data anywhere in our infrastructure.
AI processing
Rhodes uses Anthropic’s Claude API — and no other AI provider — to read documents and answer questions. Content sent to Anthropic is not used to train AI models and is retained by Anthropic for approximately 30 days for abuse prevention under their commercial terms and data processing addendum.
Service providers
These are the vendors that process data on Rhodes’ behalf, and what each one touches. Processing occurs in the United States.
| Provider | Purpose | Data touched |
|---|---|---|
| Supabase | Database, document storage, authentication | Application data, including documents |
| AWS | Inbound email receiving and storage | Emails and attachments sent to your Rhodes inbound address |
| Anthropic | AI document processing and chat | Document contents, chat messages |
| Vercel | Application hosting, product analytics | Usage data, request logs |
| Stripe | Payments, subscriptions, sales tax | Billing details (never card numbers on our side) |
| Sign-in (OAuth); inbound document mailbox; ad measurement on the marketing site | Account email and profile; inbound documents; ad-click data | |
| Resend | Transactional and marketing email | Email address, message content |
| Zendesk | Customer support ticketing | Support correspondence, account context |
| Sentry | Error monitoring | Technical logs, which may include user identifiers |
| Upstash | Rate limiting and caching | Minimal — request identifiers |
Deletion and retention
Account deletion is handled through support and completed within 30 days, with export available before deletion. Full details, including what we retain for legal obligations, are in our Privacy Policy.
What’s ahead
Security work at Rhodes is continuous: we run recurring internal security audits against the live codebase, and SOC 2 readiness work begins in fall 2026.
Reporting a vulnerability
If you believe you’ve found a security issue in Rhodes, email security@rhodesoffice.ai. We read every report and will respond promptly.