Trust Center

1. Overview

RUMA holds the operating records of rental relationships — leases, financial records, documents, and messages — so security is a product requirement, not an afterthought. This page describes, in plain terms and without marketing, what we actually do today. Where something is on the roadmap rather than in production, we say so.

2. Application security

• Authentication — passwords are hashed with PBKDF2-SHA256 and compared in constant time; repeated failed sign-ins lock the account temporarily (brute-force protection).
• Two-factor authentication — optional TOTP (authenticator app) with one-time recovery codes, stored hashed like passwords.
• Sessions — every signed-in device is listed in Settings and can be revoked remotely; changing your password signs out every other session automatically.
• Access control — workspace roles (owner, manager, viewer, tenant) enforce least privilege server-side; a tenant sees only their own lease, balance, documents, and messages.
• Audit trail — workspace activity is logged, and the audit log can be exported with a cryptographic signature so its integrity is verifiable outside RUMA.
• Hardening — a strict Content-Security-Policy (regression-tested), input size bounds on every stored field, and per-account plus per-IP rate limiting.

3. Infrastructure & encryption

The Service runs on Cloudflare's platform, including application hosting, databases, object storage, edge/API processing, Turnstile abuse prevention, AI Gateway, and the Workers AI inference path prepared for pending public RUMA Assistant activation and limited meanwhile to controlled access-restricted staging verification. Traffic is encrypted in transit (TLS). Each workspace's data is stored in its own isolated rows — workspace scoping is enforced in the data layer, not just the UI. Card details never touch our infrastructure: Stripe collects them directly (see Subprocessors).

4. Backups & disaster recovery

State is exported to durable object storage nightly, and an additional export is taken before every production deployment. The restore path is not aspirational: it is covered by an automated contract test that restores a real backup into a real database and verifies the result, and a written runbook documents the procedure.

5. Monitoring & availability

Production runs a deep health check, a scheduled end-to-end canary, storage-size gauges with thresholds, and a cron heartbeat — all wired to alerting. The API's live status and currently deployed release are public: api.ruma.rent/api/health. We do not yet publish a formal SLA or a historical uptime dashboard; paid plans come with support at support@ruma.rent.

6. Data locations

The Service is operated from the United States. Data is processed by active providers on the list below; a provider or function marked announced or pending is shown before public processing begins for that feature, with any controlled synthetic staging verification stated separately, and a former provider remains shown while deletion or retention is being verified, on the subprocessor list:

• Cloudflare, Inc. — Hosting, edge/API processing, database and object storage, Turnstile abuse prevention, operational counters, AI Gateway, and Workers AI inference — announced September 3, 2026 and pending public RUMA Assistant activation; controlled access-restricted staging verification only (USA / global edge and inference network).
• Resend, Inc. — Transactional email (invitations, reminders, security emails) (USA).
• Stripe, Inc. — Subscription payment processing (card details collected by Stripe directly) (USA).
• PostHog, Inc. — Product analytics (pseudonymized usage events) — announced ahead of activation; not yet processing Service data (USA).
• Anthropic, PBC — Former RUMA Assistant API provider — retired; no new Assistant requests (USA / global processing (data stored in USA)).

Assistant model provenance. During controlled staging verification and, after approval, public Assistant use, Cloudflare Workers AI runs the Cloudflare-hosted @cf/qwen/qwen3.8-27b model. Alibaba's Qwen team developed the model; that identification describes model provenance, not an API endpoint or recipient of Assistant messages in this deployment. RUMA does not call Alibaba Cloud or Model Studio.

7. Privacy & compliance

How we collect and use data is in the Privacy Notice; processing on business customers' behalf is governed by the Data Processing Addendum. The Service uses a single essential session cookie, and RUMA pages run no third-party advertising or tracking scripts. First-party, pseudonymized product analytics has been announced and is not yet active — the Privacy Notice and Cookie Notice describe how it will work and the analytics preference controls RUMA will implement before product analytics is activated, including Global Privacy Control, Do Not Track, and a manual opt-out. We do not sell personal information and do not train AI models on workspace content. We do not currently claim SOC 2, ISO 27001, or a third-party penetration test — when an independent assessment completes, it will be published here, not before.

8. Vulnerability disclosure

If you believe you have found a security vulnerability, email support@ruma.rent with "Security" in the subject line. Include steps to reproduce; please do not access other users' data or degrade the Service while testing. We will acknowledge your report, keep you informed, and will not pursue good-faith research that respects those boundaries. There is no paid bug-bounty program at this time.

9. Law-enforcement requests

Requests for user data from law enforcement must be directed to legal@ruma.rent (or by mail to StatGazer LLC, 418 Broadway, STE R, Albany, NY 12207, USA) and must be supported by valid legal process. We review every request for legal sufficiency and scope, produce only what the process compels, and notify affected users where the law permits us to do so.

10. Contact

Security questions and reports: support@ruma.rent ("Security" in the subject). Privacy: privacy@ruma.rent. Legal: legal@ruma.rent. Operator: StatGazer LLC, a New York limited liability company, 418 Broadway, STE R, Albany, NY 12207, USA.