Trust boundaries

Security & Compliance

RODEO BRAIN is designed around least privilege, tenant isolation, encrypted receipts, auditability, and safe separation between local simulation and production integrations.

Verification boundary: The controls below describe the current implementation and local evidence. They are not a claim of SOC 2, PCI DSS certification, or a completed independent audit.

Current controls

• Role-based access, session revocation, CSRF protection, host validation, and tenant-scoped authorization.
• Encrypted ticket receipts and secret redaction from audit records and operational logs.
• Immutable audit history and transactional event records for protected business actions.
• Backup, restore, tamper detection, and recovery verification in the local test scope.
• Signed Event Packs, expiry checks, duplicate prevention, and idempotent reconnect handling for offline workflows.

Payment and card-data boundary

The current public preview uses simulation only and does not take live payments. A production provider, tokenization design, PCI responsibility matrix, merchant scope, and webhook verification must be selected and reviewed before activation. RODEO BRAIN is not claiming that it stores no payment data in every future configuration; the configured provider architecture must enforce that boundary.

Privacy and retention

See the Privacy Notice for public inquiry data. Data minimization, provider agreements, retention schedules, breach response, and jurisdiction-specific obligations require final business and counsel review.

Independent validation roadmap

Security assessment, insurance documentation, SOC 2 or equivalent controls, PCI responsibility review, and attorney/accountant review are planned validation steps—not completed certifications.

Security contact

Security questions can be directed to support@rodeobrain.com until a dedicated security mailbox is confirmed.