Encryption is mandatory
Ripton Cloud is designed so transfers cannot be run in plaintext. Packet payloads are encrypted and authenticated as part of the protocol.
Security
Security Policy
Effective date: May 7, 2026. This page describes Ripton Cloud's security posture, vulnerability reporting process, and testing expectations.
Security controls buyers can inspect
Forward-secret sessions
Session keys are derived per session so compromise of one session does not expose previous or future sessions.
Replay and tamper protection
Authenticated packets, sequence handling, and replay windows are used to detect modification, injection, and replay attempts.
Operational visibility
Structured transfer records, transfer identifiers, session identifiers, and error events are designed to support debugging and security review without exposing key material.
Immutable audit log
Package creation, sends, views, downloads, transfer starts, completions and failures, sign-ins, and administrative changes are recorded as audit events with actor, subject, and timestamp. The audit log is append-only: the database rejects any edit to a recorded event, and events can be removed only by an administrator-configured retention policy, which itself writes an audit entry. Events can be exported to your SIEM for compliance and forensic review.
Identity and access control
Users sign in through SAML single sign-on with your identity provider or with multi-factor authentication. SCIM provisions and removes accounts, roles and workgroups separate duties, and systems use scoped credentials instead of personal logins. External recipients get time-bounded access to one package or inbox, and administrators can require MFA before a recipient downloads.
Support for compliance programmes
Ripton's controls support customers' GDPR, HIPAA, PCI-DSS and SOX programmes: mandatory encryption in transit, role-based access with MFA and SSO, the append-only audit log with SIEM export, file integrity verification, retention and expiry controls, and deployment on your own infrastructure so files never pass through a third party. Ripton Cloud does not itself hold compliance certifications; your compliance team decides how these controls fit your obligations.
Reporting a vulnerability
If you believe you have found a security issue in Ripton Cloud, email hello@riptoncloud.com with "Security report" in the subject line.
- Describe the issue, affected component, and security impact.
- Include clear reproduction steps, proof-of-concept code if useful, and relevant logs or screenshots.
- Avoid accessing, modifying, deleting, or exfiltrating data that does not belong to you.
- Avoid actions that degrade service availability, such as denial-of-service testing, spam, brute force, or destructive testing.
- Give Ripton Cloud reasonable time to investigate and remediate before public disclosure.
Safe harbor
Ripton Cloud will not pursue legal action against researchers who act in good faith, avoid privacy violations and service disruption, report issues promptly, and follow this policy. This safe harbor does not apply to unlawful activity, extortion, data theft, destructive testing, or attacks against third parties.
Out of scope
- Reports based only on missing security headers without a practical exploit path.
- Social engineering, phishing, or physical attacks.
- Denial-of-service or resource exhaustion testing.
- Automated scanner output without validated impact.
- Issues in third-party services unless they create a direct, exploitable risk to Ripton Cloud users.
Security review
Technical buyers can request a cryptographic design summary during evaluation. Ripton Cloud does not ask prospects to send sensitive production data through website forms. Evaluation data and deployment requirements should be discussed directly before testing sensitive workflows.