Security & Trust

1. Security at a Glance

The table below summarizes RestAssured’s current security posture. Detailed explanations follow in the sections below.

2. Data Encryption

Encryption is the first and most fundamental layer of data protection. RestAssured encrypts your data in two states — when it is stored and when it is moving.

Encryption at Rest

All data stored by RestAssured — including EasyVault documents, Life Readiness Assessment responses, Trust Network profiles, account information, and database records — is encrypted using AES-256. EasyVault documents use per-user encryption keys, meaning your documents are encrypted with a key unique to your account. Even in the unlikely event of unauthorized access to our storage infrastructure, your files cannot be read without your account’s encryption key.

Encryption in Transit

All data transmitted between your browser or device and the RestAssured platform is encrypted using TLS 1.2 or higher (TLS 1.3 preferred). We enforce HTTPS on all endpoints and reject unencrypted connections. HTTP Strict Transport Security (HSTS) is enabled with a 1-year max-age to prevent protocol downgrade attacks.

Key Management

Encryption keys are managed separately from encrypted data. Keys are stored in a dedicated key management service (KMS), are rotated on a defined schedule, and are never stored alongside the data they protect. Cryptographic erasure (key destruction) is used to render deleted data permanently unreadable.

Backup Encryption

All encrypted backups are encrypted at rest using the same AES-256 standard. Backup decryption keys are stored separately and subject to the same KMS controls. Backups are retained on a 90-day rolling cycle and are inaccessible to general platform operations.

3. Access Controls

RestAssured applies the principle of least privilege across all layers of the platform — from user accounts to internal engineering access to cloud infrastructure.

User Authentication

All RestAssured accounts are protected by password + multi-factor authentication (MFA). MFA is required for Enterprise accounts and strongly recommended for all users. We support TOTP authenticator apps (Google Authenticator, Authy) and SMS-based OTP. Passwords are hashed using bcrypt with a per-user salt and are never stored in plaintext.

Enterprise SSO

Enterprise customers may connect their own identity provider via SAML 2.0 (SSO). When SSO is enabled, RestAssured defers authentication to the customer’s identity provider, allowing centralized access management, automatic deprovisioning, and enforcement of the customer’s own MFA and conditional access policies.

Role-Based Access Control (RBAC)

Access within the RestAssured platform is scoped by account tier and user role. Free and paid individual users access only their own data. Enterprise accounts have administrator roles that control which Authorized Users can access which features and documents. No user can access another user’s EasyVault, Trust Network, or Life Readiness data.

Internal Access Controls

RestAssured employees do not have standing access to user data. Production database access requires a formal access request, manager approval, and time-limited credentials. All internal access to production systems is logged and auditable. Customer Support agents can view account metadata (plan status, support history) but cannot access EasyVault document contents.

Session Management

Authenticated sessions expire after a defined period of inactivity. Users receive a visible and announced warning before session expiration. Session tokens are rotated on authentication and invalidated on logout. Concurrent sessions from multiple devices are supported with the ability to remotely revoke sessions from account settings.

4. Infrastructure Security

RestAssured is a cloud-hosted SaaS platform. Our infrastructure is designed with security, reliability, and isolation in mind.

Cloud Hosting

RestAssured runs on [Cloud Provider] infrastructure within the United States. We do not host data outside the U.S. without explicit customer consent. Our cloud provider holds SOC 2 Type II, ISO 27001, and FedRAMP certifications, which establish the baseline security of the physical and virtual infrastructure we run on top of.

Network Segmentation

Production systems are isolated from development and staging environments through separate virtual private clouds (VPCs) and network access control lists (NACLs). Database servers are not publicly accessible — they are reachable only from application servers within the same VPC. Outbound traffic is filtered through an allowlist.

Web Application Firewall (WAF)

A WAF is deployed in front of all public-facing endpoints to detect and block common web application attacks, including SQL injection, cross-site scripting (XSS), and malformed request payloads. Rate limiting is enforced on all authentication and API endpoints.

Intrusion Detection and Monitoring

RestAssured monitors infrastructure and application logs in real time for anomalous activity, including failed authentication spikes, unusual data export volumes, and unexpected API call patterns. Alerts are routed to the on-call security team. Security logs are retained for 24 months.

DDoS Protection

RestAssured uses cloud-native DDoS protection and a content delivery network (CDN) to absorb volumetric attacks and maintain availability for legitimate users during an attack event.

Patch Management

Operating system and dependency patches are applied on a defined schedule. Critical security patches (CVSS ≥ 9.0) are applied within 24 hours of a stable patch being available. High-severity patches (CVSS 7.0–8.9) are applied within 7 days. All other patches are applied within 30 days.

5. Application Security

Security is built into the RestAssured software development lifecycle, not bolted on afterward.

Secure Development Lifecycle (SDL)

All new features undergo a security design review before development begins. Engineers follow OWASP Top 10 guidance as a baseline. Code changes are peer-reviewed before merging. Security-sensitive changes (authentication, authorization, encryption, data export) require explicit security team sign-off.

Automated Security Scanning

RestAssured’s CI/CD pipeline includes static application security testing (SAST) using industry-standard tooling to catch common vulnerabilities before code is deployed. Dependencies are scanned for known CVEs on every build. High and critical findings block deployment until resolved.

Penetration Testing

RestAssured targets an annual third-party penetration test of the web application and API surface, conducted by an independent security firm. A summary of findings and remediation status is available to Enterprise customers under NDA upon request to support@restassured.life.

Dependency Management

Third-party libraries and packages are tracked in a software bill of materials (SBOM). Automated tools flag vulnerable dependencies on a daily basis. We do not use end-of-life or unsupported dependencies in production.

Input Validation and Output Encoding

All user-supplied input is validated server-side before processing. Output is encoded to prevent XSS in all rendering contexts. SQL queries use parameterized statements throughout — we do not construct queries by string concatenation.

API Security

All RestAssured APIs require authentication via short-lived access tokens (JWT). Tokens are scoped to the minimum permissions required. API rate limiting is enforced per account and per endpoint. API responses never include more data than the authenticated user is authorized to see.

6. Remy AI — Security and Data Handling

Remy, our AI life readiness assistant, is one of RestAssured’s most distinctive features — and one that raises legitimate questions about data handling. Here is exactly how it works.

How Remy Processes Your Data

When you type a message to Remy, your input is sent over TLS to the RestAssured application server, which constructs a prompt (including your session context) and forwards it to our AI provider’s API. The response is streamed back to your browser over the same encrypted connection. Remy does not have standing access to your EasyVault documents — documents are included in a Remy session only if you explicitly share them during that session.

No Training on Your Data

Your conversations with Remy and your EasyVault documents are not used to train, fine-tune, or evaluate any AI model — by RestAssured or by our AI provider. Our agreement with our AI provider explicitly prohibits use of our API traffic for model training. Enterprise customers receive this guarantee in writing in the Data Processing Addendum.

Remy Log Retention

Conversation logs are retained for 90 days for quality assurance, safety monitoring, and abuse detection, then automatically and permanently deleted. During the retention period, logs are encrypted at rest and accessible only to authorized RestAssured personnel for safety and support purposes.

Prompt Injection and Jailbreak Protections

Remy is configured with system-level instructions that define its role and restrict it from being manipulated into producing harmful, deceptive, or out-of-scope outputs. Prompt injection attempts (where a user tries to override Remy’s instructions by embedding commands in their input) are detected and logged as AUP violations. Repeated abuse may result in account suspension.

Session Isolation

Each Remy session is isolated by account. Remy cannot access another user’s session history, documents, or account data. Session context is cleared at the end of each session and is not persisted to the next session unless the user explicitly saves a conversation summary.

7. EasyVault — Document Security

EasyVault is RestAssured’s encrypted document storage feature — the place where you store wills, insurance policies, financial account information, and other critical life documents. We apply enhanced security controls here specifically because of the sensitivity of these documents.

Per-User Encryption Keys

Every EasyVault is protected by an encryption key unique to that user account. Documents stored in EasyVault are encrypted with your key before being written to storage. Even RestAssured employees with database access cannot read the contents of your documents without your account’s encryption key.

Access Logging

Every access to an EasyVault document — view, download, share — is logged with timestamp, user ID, and IP address. Enterprise administrators can review access logs for their organization’s EasyVault at any time. Anomalous access patterns (e.g., bulk downloads from an unusual location) trigger automated alerts.

Trust Network Sharing

When you share a document with a Trust Network contact, a time-limited, scoped access token is generated. This token grants access only to the specific document(s) you designated, for the duration you specified. Shared access can be revoked at any time from your EasyVault settings.

Deletion

When you delete a document from EasyVault, it is immediately removed from the active storage layer and the encryption key association is severed. Backup copies are overwritten within 90 days via the rolling backup cycle. Deletion is permanent — RestAssured cannot recover deleted EasyVault documents.

Supported File Types and Scanning

EasyVault accepts common document formats (PDF, DOCX, XLSX, JPEG, PNG, and others). Uploaded files are scanned for known malware signatures before being stored. Files that fail the malware scan are rejected and not stored.

8. Compliance and Certifications

RestAssured is a growing startup and we are honest about where we are in our compliance journey. We do not overclaim certifications we have not yet achieved.

9. Sub-Processors

RestAssured uses a limited, vetted set of third-party service providers (“sub-processors”) to deliver the platform. Each sub-processor is bound by a data processing agreement requiring them to protect your data at least as well as we do. We do not sell your data to sub-processors — they receive only what is necessary to perform their function.

We will notify Enterprise customers of material sub-processor changes at least 30 days in advance, providing an opportunity to object. A continuously updated sub-processor list is maintained at www.restassured.life/legal/sub-processors.

10. Incident Response

RestAssured maintains a documented incident response plan for security events affecting user data. Our plan follows four phases:

Phase 1: Detection & Triage (0 – 4 hours)

Security monitoring alerts fire. On-call engineer triages the event. If confirmed as a potential breach, the incident response team is activated and the event is logged in the incident record. The severity level is assigned.

Phase 2: Containment (4 – 24 hours)

Affected systems are isolated. Credentials and access tokens associated with the incident are rotated. The attack vector is identified and blocked. Evidence is preserved for forensic analysis.

Phase 3: Notification (24 – 72 hours)

Affected users are notified by email without undue delay, and in any event within 72 hours of confirming that personal data was compromised. Notification includes: what happened, what data was affected, what we have done, and what you can do. Regulatory notification (Minnesota breach law) is completed as required.

Phase 4: Remediation & Review (72 hours+)

The root cause is remediated. A post-incident review is conducted within 2 weeks. Findings are incorporated into security controls and the incident response plan. A summary of the incident and remediation is published to affected customers.

11. Availability and Reliability

Uptime Commitment

99.5% monthly uptime for the RestAssured web application (app.restassured.life). Excluding scheduled maintenance windows (notified 48 hours in advance), emergency maintenance, force majeure events, and customer-caused outages. Enterprise customers receive SLA credits per the Enterprise Subscription Agreement.

Backup and Recovery

Encrypted backups of all platform data are created daily and retained on a 90-day rolling cycle. Recovery Time Objective (RTO): 4 hours for critical systems. Recovery Point Objective (RPO): 24 hours (last backup). Backup restoration is tested quarterly.

Geographic Redundancy

RestAssured runs in multiple availability zones within the United States to provide redundancy against single-zone failures. Database replication is configured for automatic failover.

Maintenance Windows

Scheduled maintenance is performed during low-traffic windows (Sundays, 12:00 AM – 4:00 AM Central Time). Users are notified at least 48 hours in advance via email and an in-app banner. Emergency maintenance may be performed without advance notice when required to address a critical security issue.

12. Organizational Security

Technology controls are only as strong as the people and processes behind them.

Security Training

All RestAssured employees complete annual security awareness training covering phishing recognition, secure data handling, and incident reporting. Engineers complete role-specific secure development training (OWASP, threat modeling) annually. New hires complete security onboarding within their first two weeks.

Background Screening

All employees and contractors with access to production systems or user data undergo background screening as part of the hiring process, consistent with applicable law.

Confidentiality Agreements

All employees, contractors, and vendors with access to RestAssured systems or user data sign confidentiality and data handling agreements before being granted access.

Access Deprovisioning

Employee and contractor access to all RestAssured systems is revoked within 24 hours of departure or role change. Shared credentials are rotated immediately upon offboarding.

Vendor Risk Management

Third-party vendors with access to RestAssured systems or user data are assessed for security posture before engagement and periodically thereafter. Vendors must sign a data processing agreement and provide evidence of their own security controls (e.g., SOC 2 report, ISO 27001 certificate).

13. Vulnerability Disclosure Policy

RestAssured welcomes responsible disclosure of security vulnerabilities. If you discover a security issue in our platform, we ask that you give us the opportunity to investigate and remediate before public disclosure.

How to Report

• Email: support@restassured.life
• Subject: “Vulnerability Report — [brief description]”
• PGP Key: Available at www.restassured.life/security/pgp-key.asc
• Response Target: 24 hours (acknowledgment); 5 business days (triage + severity assignment)

Our Commitments to Reporters

• We will acknowledge your report within 24 hours.
• We will not pursue legal action against researchers who follow this policy.
• We will keep you informed of our investigation and remediation progress.
• We will credit you in our disclosure (with your consent) once the issue is resolved.
• We target remediation within 90 days of confirmed vulnerability, faster for critical issues.

90-Day Disclosure Policy

After 90 days from the date of our initial confirmation of a valid vulnerability, you are free to publicly disclose the issue regardless of remediation status, provided you give us 7 days’ advance notice of your planned disclosure. We may request a short extension for critical issues that require complex remediation or coordinated disclosure with third parties.

Scope

In scope for vulnerability reports:

• www.restassured.life and app.restassured.life
• RestAssured API endpoints
• Remy AI interface
• EasyVault document storage
• Authentication and session management

Out of scope:

• Social engineering attacks against RestAssured employees
• Physical security attacks
• Denial-of-service attacks
• Third-party services (Stripe, cloud provider, etc.) — report those to the respective vendor
• Issues requiring physical access to a user’s device

14. What You Can Do to Stay Secure

Security is a shared responsibility. Here are the most important steps you can take to protect your RestAssured account:

• Enable MFA: Multi-factor authentication is the single most effective control against account takeover. Enable it in Account Settings → Security → Two-Factor Authentication.
• Use a strong, unique password: Use a password manager to generate and store a unique password for RestAssured. Do not reuse passwords across sites.
• Keep your email address current: Your email is your primary account recovery mechanism. An outdated or inaccessible email makes account recovery difficult if you are locked out.
• Review your Trust Network regularly: Periodically review who has access to your Trust Network and EasyVault shares. Revoke access for contacts who no longer need it.
• Download your EasyVault documents: Maintain a local or cloud backup of important documents. RestAssured is not a permanent archive service and data is deleted after account closure.
• Log out on shared devices: Always log out of RestAssured on shared or public computers. Use the “Sign out all devices” feature if you suspect unauthorized access.
• Report suspicious activity: If you notice something unusual — unexpected login notifications, documents you didn’t upload, Remy conversations you didn’t initiate — contact support@restassured.life immediately.

15. Contact and Further Information

For security questions, vulnerability reports, or to request security documentation (SOC 2 report, pen test summary, DPA) for enterprise due diligence:

• Security, Privacy and General Support: support@restassured.life
• Legal: legal@restassured.life
• Legal Hub: www.restassured.life/legal
• Sub-Processors: www.restassured.life/legal/sub-processors
• Address: RestAssured LLC, 985 Lake Street, #1024, Wayzata, MN 55391

Related documents available at www.restassured.life/legal: Privacy Policy · Data Processing & Security Statement · Data Retention & Deletion Policy · Acceptable Use Policy · Cookie Policy · Accessibility Statement

© 2026 RestAssured LLC · 985 Lake Street, #1024, Wayzata, MN 55391 · www.restassured.life · support@restassured.life