Security

Last updated August 6, 2026

Rhodes holds some of the most sensitive documents a family has: operating agreements, tax filings, trust instruments, account statements. This page describes, plainly and without exaggeration, how that data is protected. Every statement here is verified against how the product is actually built before it is published.

Encryption

All traffic to and from Rhodes is encrypted in transit using TLS, and our domains are HSTS-preloaded so browsers refuse unencrypted connections. Data is encrypted at rest by our infrastructure providers (Supabase and AWS).

Per-organization isolation

Every organization’s data is isolated with database-level Row-Level Security policies on all organization-scoped tables, plus per-request organization checks in the application layer. One customer’s records are never visible to another.

Authentication

Sign-in is handled through Google OAuth — Rhodes never stores passwords. Multi-factor authentication (TOTP authenticator apps) is available, and step-up verification is required for sensitive actions inside the product.

Audit logging

Rhodes keeps an append-only audit log of activity in your organization. No user or application path can modify or delete audit entries; audit records are removed only when an organization is permanently deleted.

Backups

Databases are backed up nightly with encrypted backups, and backup restoration is tested. Residual copies in backups are purged within 90 days through scheduled rotation, consistent with our Privacy Policy.

Payments

Payments are processed on Stripe-hosted pages. Your card number is entered directly with Stripe and never touches Rhodes’ systems — there is no card data anywhere in our infrastructure.

AI processing

Rhodes uses Anthropic’s Claude API — and no other AI provider — to read documents and answer questions. Content sent to Anthropic is not used to train AI models and is retained by Anthropic for approximately 30 days for abuse prevention under their commercial terms and data processing addendum.

Service providers

These are the vendors that process data on Rhodes’ behalf, and what each one touches. Processing occurs in the United States.

ProviderPurposeData touched
SupabaseDatabase, document storage, authenticationApplication data, including documents
AWSInbound email receiving and storageEmails and attachments sent to your Rhodes inbound address
AnthropicAI document processing and chatDocument contents, chat messages
VercelApplication hosting, product analyticsUsage data, request logs
StripePayments, subscriptions, sales taxBilling details (never card numbers on our side)
GoogleSign-in (OAuth); inbound document mailbox; ad measurement on the marketing siteAccount email and profile; inbound documents; ad-click data
ResendTransactional and marketing emailEmail address, message content
ZendeskCustomer support ticketingSupport correspondence, account context
SentryError monitoringTechnical logs, which may include user identifiers
UpstashRate limiting and cachingMinimal — request identifiers

Deletion and retention

Account deletion is handled through support and completed within 30 days, with export available before deletion. Full details, including what we retain for legal obligations, are in our Privacy Policy.

What’s ahead

Security work at Rhodes is continuous: we run recurring internal security audits against the live codebase, and SOC 2 readiness work begins in fall 2026.

Reporting a vulnerability

If you believe you’ve found a security issue in Rhodes, email security@rhodesoffice.ai. We read every report and will respond promptly.