SECURITY & DATA PRACTICES
Security & Data Practices
Last updated: August 22, 2026
What this page represents
This page describes security and data-handling controls currently implemented or configured for Revenue Recovery AI. It is intended to distinguish verifiable application controls from independent certifications.
Revenue Recovery AI does not claim that the Revenue Recovery AI service itself is independently SOC 2, ISO 27001, or similarly certified unless such a certification is expressly identified here in the future. Certifications held by infrastructure or service providers do not automatically certify Revenue Recovery AI.
Service operator
Revenue Recovery AI is operated by Business Revenue Recovery. Security reports and data-practice questions can be sent to hello@businessrevenuerecovery.com .
Hosting
The production web service is configured on Render in the Virginia region of the United States.
The active SQLite application database is stored on a Render persistent disk. Render states that persistent disks and their automatic snapshots are encrypted at rest.
Transport and browser security
The production application is served through HTTPS. The application also sends security headers including HSTS in production, Content Security Policy, frame restrictions, content-type protections, and a restrictive referrer policy.
Authenticated application pages are marked to prevent browser and intermediary caching of sensitive page content.
Business-level data separation
Customer analyses, search results, history, recovery records, imports, and related application queries are scoped to a business identifier. Business roles do not grant cross-business access.
Revenue Recovery AI supports Owner, Operator, and Viewer roles. Owners have administrative permissions such as billing, access management, audit access, and destructive data controls. Operators can perform operational work but do not receive Owner-only administrative permissions. Viewers receive read-oriented access.
Account verification
New security-managed accounts use email verification. Login verification can also be enabled using supported verified email or SMS destinations.
Twilio Verify is used for supported verification delivery and verification checks. Revenue Recovery AI stores the verification state needed by the application, while raw one-time verification codes are handled through the verification provider.
Password and invitation tokens
Password-reset and business-invitation tokens are stored in the Revenue Recovery AI database as hashes rather than as the raw token value. Raw secure links are delivered to the intended recipient through the applicable communication channel.
Temporary upload processing
New source-document uploads are configured to use ephemeral temporary storage outside the application's Render persistent data directory.
The upload workflow attempts to delete the temporary source file in a finally-style cleanup path after processing, including when analysis raises an exception.
Saved Analysis Records contain derived information such as filename, document hash, financial values, AI reasoning, and findings. They do not store a retained source-file path.
AI data flow
OpenAI's API is used for AI-assisted reasoning. The currently audited application flow builds structured requests from extracted and derived information rather than sending the customer's original uploaded file as a direct file attachment.
Depending on the feature, structured AI context can include a filename, invoice fields, contract fields, accounting records, financial amounts, findings, and recovery-case information.
OpenAI states that API Platform business data is not used for model training by default unless the API customer explicitly opts in. Standard API inputs and outputs may be retained by OpenAI for up to 30 days unless a different eligible retention configuration applies. Revenue Recovery AI does not currently claim Zero Data Retention.
Human control over recovery actions
Recovery actions begin in a draft state. The application records approval status, reviewer, review time, and reviewer notes. Execution is blocked unless the action has been approved.
Customer contact is designed to require both an approved recovery action and a human-triggered execution step.
Audit trail
Revenue Recovery AI records business-scoped application audit events for important security, access, billing, and recovery activity. Normal customer application routes do not provide mutation or deletion controls for individual audit events.
A complete Owner-authorized workspace deletion removes the business's active audit-event records together with the workspace.
Analysis deletion
An Owner can delete an individual analysis after entering an exact confirmation. The deletion engine removes the analysis and its dependent findings and recovery graph from active storage, redacts associated import metadata, and clears potentially stale cross-document reasoning within that business.
Workspace deletion
Workspace deletion is Owner-only, CSRF-protected, requires an exact confirmation phrase and the Owner's current password, and invalidates the active browser session after successful deletion.
The deletion transaction is explicitly business-scoped and is tested to preserve another tenant's records.
Subscription cancellation
Subscription cancellation changes billing entitlement; it does not silently delete customer data. Workspace deletion is a separate explicit action.
Application backups
The application creates integrity-checked SQLite database backups. The default backup interval is 24 hours.
Application-created backup files are configured for a 14-day age limit when the backup cycle runs, together with a separate 14-copy limit. Age pruning runs even when creation of a new backup is not yet due.
Render snapshots
Render creates an automatic snapshot of the persistent disk once every 24 hours. Render states that snapshots are encrypted at rest and available for at least seven days.
Render does not describe that seven-day period as a maximum retention guarantee. Revenue Recovery AI therefore does not claim that provider-managed snapshots are always erased within seven days.
Operational and administrative access
Customer business roles are tenant-scoped. A separate founder-only application route exists for private product feedback and does not grant customer business roles cross-business access.
Authorized infrastructure operators can have technical access to production systems when necessary for maintenance, support, security, backup recovery, or incident response. Such access should be limited to an operational need.
Current service providers and data categories
Render
Purpose: hosting and persistent infrastructure. Potential data: application database, application-created backups, logs, and infrastructure metadata.
OpenAI
Purpose: AI reasoning and generation. Potential data: structured information derived from authorized business records and recovery cases.
Stripe
Purpose: subscription and payment processing. Potential data: account email, billing identifiers, subscription identifiers, plan and payment status, and related transaction metadata.
Twilio Verify
Purpose: email/SMS account verification. Potential data: verification destination and verification-related metadata. Revenue Recovery AI does not use this notification path to send uploaded business documents.
Twilio SendGrid
Purpose: transactional email. Potential data: recipient email address, email subject and body, secure reset or invitation link, and for team invitations the applicable business name and access role. Uploaded invoices and contracts are not sent through this notification path.
Incident reporting
Suspected unauthorized access, security vulnerabilities, or privacy incidents can be reported to hello@businessrevenuerecovery.com . Please include enough information to investigate the issue without sending unnecessary sensitive customer records by email.
Related policies
See the Privacy Policy and Terms of Use for additional information.