Security

Effective: July 6, 2026

Security is fundamental to how we build and operate RDS360. This page describes the technical and organizational measures we use to protect your data and our infrastructure.

Our approach

RDS360 handles order, payment, and delivery data on behalf of restaurants, marketplaces, and delivery service providers. We treat that data as a serious responsibility. Our approach follows industry-standard security practices with an emphasis on defense in depth: multiple overlapping safeguards so no single failure exposes your information.

Data encryption

In transit

All communication between clients (web browsers, mobile apps, integrations) and our servers is encrypted using TLS 1.2 or higher. HTTPS is enforced across all customer-facing endpoints, and certificates are managed via a trusted certificate authority.

At rest

Customer data stored in our databases and object storage is encrypted at rest using AES-256. Backups are encrypted with the same standard.

Access controls

Role-based access control across the platform, with distinct permission scopes for customers, drivers, restaurant staff, platform operators, and system administrators.
Strong authentication including phone-based one-time passwords, secure session management, and rotating refresh tokens with instant revocation.
Least-privilege principle for internal team access to production systems, with production access limited to a small number of engineers.
Audit logging of sensitive administrative actions, including account changes, role changes, and access to financial records.

Payment security

Payment processing is handled by Stripe, a Level 1 PCI DSS-certified payment provider. Full payment card numbers are never stored on RDS360 servers. Card data is tokenized by Stripe, and only tokens are retained on our systems for the purpose of processing future transactions.

Webhook payloads from payment processors are cryptographically signature-verified before being processed. Payment disputes and chargebacks are handled through automated integration with Stripe.

Infrastructure

The RDS360 platform is hosted on Amazon Web Services (AWS), a leading cloud infrastructure provider with SOC 2, ISO 27001, and PCI DSS certifications. Key infrastructure components:

Compute: AWS EC2 with hardened operating system images
Database: AWS RDS (managed PostgreSQL) with SSL-only connections
Object storage: AWS S3 with server-side encryption
Edge and DDoS protection: Cloudflare
Content delivery: Cloudflare CDN for global performance

Application security

Input validation and parameterized database queries to prevent injection attacks
Cryptographically secure random number generation for one-time passwords, PINs, and session tokens
Rate limiting and abuse detection on authentication and sensitive endpoints
Automated bot detection with block lists sourced from multiple threat intelligence feeds
Content Security Policy and standard secure HTTP response headers
Server-side authoritative calculation of order totals, discounts, and credits to prevent client-side tampering

Monitoring and incident response

We maintain continuous monitoring of our infrastructure, including application health, error rates, database performance, and security events. Our team is alerted to critical anomalies and follows a documented incident response process for suspected security incidents:

Detection and triage
Containment
Investigation and root-cause analysis
Remediation
Notification to affected parties (as required by law and contract)
Post-incident review and process improvement

Backups and disaster recovery

Databases are backed up daily with encrypted snapshots. We test our restore process regularly. In the event of a major infrastructure failure, backups can be restored to a new environment to minimize service disruption.

Data isolation (multi-tenant)

RDS360 operates a multi-tenant white-label platform where each tenant runs on isolated infrastructure. Each tenant has its own database and application server, ensuring strict logical and physical separation of data across tenants.

Vendor and third-party management

We work with third-party providers who meet our security standards. Key vendors — including Stripe, AWS, Cloudflare, Twilio, and Google — are enterprise-grade providers with their own robust security programs and compliance certifications.

Employee security

Background checks for personnel with production access, where permitted by law
Security awareness training
Enforced use of strong passwords and multi-factor authentication for internal systems
Confidentiality obligations in every employment and contractor agreement

Compliance

We design our practices with the following frameworks in mind:

PCI DSS — payment processing handled by PCI-certified providers (Stripe); we never store raw card data
CCPA / CPRA — California resident privacy rights (see our Privacy Policy)
GDPR — European data protection principles for applicable users
SOC 2 Type II — planned; not yet certified

Responsible disclosure

Found a security issue? We appreciate reports from security researchers. Please email getstarted@tryrds360.com with the subject line "Security Report" and include:

Description of the issue and its potential impact
Steps to reproduce
Any supporting materials (screenshots, proof-of-concept)

We ask that you not exploit the issue beyond what is necessary to demonstrate it, and that you give us reasonable time to remediate before public disclosure.

Questions

For security-related questions, contact getstarted@tryrds360.com.