Is ModelRiver SOC 2 or ISO 27001 certified?
Updated
Not yet. ModelRiver doesn't hold a SOC 2 or ISO 27001 certification today. We're happy to answer your security questionnaire and walk your team through our controls.
What controls do you have in place?#
The main ones are published on our security page:
- HTTPS on every connection, and encrypted storage of provider keys (AES-256-GCM)
- Hashed API keys, two-factor sign-in and four access roles
- Separation between organizations, rate limiting and protection against requests to private networks
- Signed webhooks
- Daily backups with tested restores
- Security incident notification within 72 hours
How do I start a security review?#
Email team@modelriver.com or use contact sales with your questionnaire or the questions you need answered. Security reviews, DPAs and contracts are part of what that team handles.
Can I audit ModelRiver?#
Under our Data Processing Agreement you can audit once a year, at your own cost, with 30 days' notice. In most cases a questionnaire and our documentation answer what auditors need.
What do I need to do on my side?#
Certification covers ModelRiver; your own compliance also depends on how you use it. Common steps:
- Keep personal data out of prompts where you don't need it.
- Turn off saving full request text in projects that handle sensitive data.
- Use roles and project protection to limit who can change production.
- Rotate API keys and give them an expiry.