Security

Last updated: November 5, 2026

This page describes how Itasca Innovation, Inc. ("Itasca", "we") protects the Itasca Platform, sold as RIFFL, and the apps and data it hosts. It describes what the Platform does today. For what we collect and why, see our Privacy Policy.

Where it runs

The Platform and every app on it run on Google Cloud, in the United States (us-central1). Apps run on Cloud Run, the Platform's records are kept in Firestore, and app databases are kept in Cloud SQL for PostgreSQL, all in that region. We operate no servers of our own.

Signing in

• Sign-in is through Google or Microsoft. There are no Platform passwords to steal or reuse. Multi-factor authentication, password rules and session limits are those your organisation sets in its own identity provider.
• Only a verified address is an identity. We accept a Google address only when Google has verified it, and a Microsoft address only when the issuing directory has verified its domain.
• An organisation decides who joins it. A person outside an organisation's claimed domains is admitted only when one of its owners invites them. An unknown domain is refused rather than given an account.
• An organisation can require single sign-on. An emailed sign-in link then gives no access to it.
• Access is checked on every request. Removing a person, or suspending them, takes effect immediately rather than when a session expires.
• Connecting an AI assistant always asks the person first, on a page naming the assistant and the organisation it will act for.

Keeping organisations apart

• Each organisation's apps run under their own service account, with access to that organisation's database and secrets and nothing else.
• Each organisation's data is in its own database, reached with short-lived credentials. Apps hold no database password.
• Each app has its own web address, so one app's pages cannot read another's, or the Platform's own sign-in.
• An app's source is built in isolation, under an identity that can push that build and nothing else.

Who can open an app

Apps are private by default, inside the organisation as well as outside it. The Platform is the only way to reach an app: it is not reachable on its underlying cloud address. A person opens an app only if they own it, it has been shared with them, they are one of the organisation's owners, or they were invited to it by name. Only an Itasca administrator can make an app public, at the organisation's request.

Encryption and secrets

• In transit: every connection to the Platform and to apps uses HTTPS. Apps reach their database over Google's private network with TLS.
• At rest: all stored data is encrypted by Google Cloud.
• Secrets (API keys an organisation gives its apps, and tokens for services it connects such as Google, Microsoft or HubSpot) are kept in Google Secret Manager. They are never shown back to anyone, and an app receives a connected service's access only as a short-lived token.

AI features

AI calls are made through the Platform on Google Cloud's Vertex AI. Apps hold no AI credential of their own. We record the model, its token counts and its cost for each call, and keep no prompt or response text.

If an organisation connects its Gemini Enterprise, we read its activity log through a dedicated identity, riffl-telemetry, which holds read access to logs in that organisation's project and nothing else. The organisation grants the access and can withdraw it at any time. We keep daily counts of use and never the text of a question or an answer.

How we run it

• Least privilege. The Platform and our staff hold only the permissions their work needs. Our Google Cloud organisation forbids long-lived service-account keys; automated work uses short-lived credentials.
• Changes are tested and confirmed by a person. Every change to the Platform runs first on a separate test copy and its test suites, is then placed on production without traffic and checked there, and reaches customers only when a member of our team confirms it. The previous version is kept ready, and returning to it takes seconds.
• Database changes take a backup first. Before an app's database is changed, a copy of its tables is taken. Cloud SQL also keeps daily backups and point-in-time recovery.
• One outbound address. All traffic leaving the Platform and its apps comes from a single published IP address, so you can allowlist it.
• Logs are kept by Google Cloud Logging and read when needed. We do not copy them into other systems.

Reporting a vulnerability

If you believe you have found a security problem, write to support@itascainnovation.ai with "Security" in the subject. Please give us a reasonable chance to fix it before telling anyone else. We will acknowledge your report within two business days.

Incidents

If we learn of a breach affecting your data, we will notify the owners of your organisation without undue delay, and as the law requires, with what we know and what we are doing about it.

Questions

Customers and prospective customers can ask for our answers to a security questionnaire at support@itascainnovation.ai.