Trust centre · 9:30 a.m.

Here's exactly what we can touch.

RautingTech works inside your own environment with the least access that does the job. This page lists what we access, where your data lives, who processes it, and the certifications we do and don't hold. Send us your security questionnaire and we'll answer it in writing.

Compliance is the floor, not the ceiling. We work inside the boundaries of compliance even where no rule requires it.

  • If we don't need to read your data, we don't.
  • If we don't need to store your data, we don't.
  • If we do need to store it, it's kept safe and isolated.

Last updated

Everything a reviewer asks for, in one request.

  • Client data safeguards S-01 to S-10, with the controls behind each
  • Sub-processor list and data locations
  • Flow Trace security model and permissions
  • Incident response summary
Request the security pack

Sent within 3 business days

Which certifications does RautingTech hold?

The plain answer, including the ones we don't have yet.

Credentials held and not held
CredentialStatusEvidence
Microsoft Solutions PartnerNOT HELDRegistered Azure Marketplace publisher; no partner designation
Canadian ISVYESIndependent Canadian software vendor; Flow Trace in early access
PIPEDAAPPLIESPrivacy policy. Requests answered within 30 days
WCAG 2.2 AATARGETEDThis site is built and tested to it; client builds include it by default
SOC 2 Type IINOT HELDOur safeguards S-01 to S-10 are documented in the security pack
ISO/IEC 27001NOT HELDPursued when a customer requires it

This is how we read your data: only the parts the job needs.

When we trace why a record changed, we need to know what ran against it and when. We don't need to know who your customer is, what they owe or what they said to your team, so we don't read it.

An illustration of the principle, not a real record.

Record · AccountRead for: tracing a status change
Account name
Brightwater Facilities Group
Primary contact
Dana Okafor
Email
d.okafor@example.com
Credit limit
$250,000
Status
On hold → Active
Modified by
Flow: Sync account status
Modified on
02:03:41
Notes
Customer called about invoice dispute, promised a callback
Three fields read. Five never opened.

Ten commitments we work to on every engagement.

Ask for them in your agreement and we put them in writing, so you can hold us to it.

  1. S-01
    Least privilege

    Read-only roles by default. Each permission is listed with its purpose before we ask for it.

  2. S-02
    Multi-factor sign-in

    Every account that touches your systems uses MFA through Microsoft Entra ID.

  3. S-03
    Your environment, your data

    We work inside your own tenant, subscription or platform. We don't copy production data out.

  4. S-04
    Secrets in a vault

    Keys live in a key vault, never in code, documents, email or chat. Anything exposed is rotated.

  5. S-05
    Change control

    Every change goes through source control and your release path. No hand edits in Production.

  6. S-06
    Data register

    Every field a build stores is recorded with its purpose, protection and retention.

  7. S-07
    Access removal

    Our access ends within 5 business days of handover, unless you keep a care plan.

  8. S-08
    Incident notice

    If something we're responsible for affects your data, you hear from us within 24 hours.

  9. S-09
    Tamper-evident logs

    Our products keep hash-chained audit trails, so an edited entry shows exactly where.

  10. S-10
    Named sub-processors

    Every service that handles data for us is listed below, and you hear before we add one.

Where does Flow Trace keep our data?

In your own Azure subscription. RautingTech never receives it.

Your Azure subscription
Flow Trace appManaged identity, no shared secrets
Your storage accountTrace data, encrypted
Your key vaultThe encryption key
Your Dataverse environments

Read: run history and metadata. Never writes to flows, records or solutions.

RautingTech

Publishes signed releases. Holds none of your trace data.

Full Flow Trace security model

Who processes data for RautingTech?

Two providers, for this website, email and booking. Systems we build for you run in your own cloud, under your agreements with your providers.

Sub-processors
ProviderPurposeData
Microsoft AzureWebsite hosting, first-party page analytics, contact form storageName, email, company, message, newsletter consent; anonymous page-view events
Microsoft 365Email and call bookingName, email, meeting time

No cookies, no advertising trackers, no third-party fonts or scripts on the public pages of this site. Page analytics are first-party and anonymous; see the privacy policy.

Talk to a person

  1. Security
    Report a security issue

    info@rautingtech.com, subject "Security"

  2. Privacy
    See, correct or delete your data

    info@rautingtech.com, subject "Privacy request"

  3. Concern
    Raise a concern about our conduct

    info@rautingtech.com, subject "Concern" · read by Vince Rauti, Founder

NextMeet the principalWhy RautingTech exists, and how Vince works.