How your data is protected
Every application Ridgeline builds runs on the Base44 platform — an independently audited, SOC 2 Type II and ISO 27001 certified environment. Here is exactly how your information is hosted, encrypted and access-controlled.
Independently audited controls for security, availability and confidentiality. Full report available under NDA.
Certified information security management system covering people, process and technology.
Compliant data handling with a Data Processing Agreement available on request.
Certified payment processing for any application that accepts card payments.
Encryption
Your data is encrypted everywhere it lives and everywhere it moves.
- All data tables, file storage and private application data are encrypted at rest.
- Every connection between browsers, mobile apps and the platform is encrypted in transit using TLS (HTTPS) — plain HTTP is never served.
- API keys, third-party credentials and integration tokens are stored as managed secrets, never in application code or the database.
- Encryption is enforced at the platform level, so it can't be accidentally disabled by a configuration change.
Hosting & data residency
Applications run on Base44's managed cloud infrastructure.
- Infrastructure is hosted in the United States by default, on cloud providers with their own independent security certifications.
- EU and UK data-residency clusters are available for clients with regional storage requirements.
- Redundant, monitored infrastructure with automated backups protects against data loss and downtime.
- A published subprocessor directory lists every vendor that touches your data — no hidden third parties.
Authentication & access control
Only the right people see the right records.
- Managed authentication with secure session tokens and email verification — passwords are never handled by your application code.
- Role-based permissions (e.g. admin, staff, customer) restrict what each user type can view and change.
- Row-level security rules enforce data isolation in the database itself, so users can only read or edit records they're entitled to — even if the front end is bypassed.
- Sensitive server-side operations run in isolated backend functions, never in the browser.
Threat protection
Continuous testing keeps the platform ahead of new risks.
- Regular penetration testing by internal security teams and independent third parties.
- A public bug-bounty program for responsible vulnerability disclosure.
- Every public endpoint is rate-limited by default to blunt brute-force and abuse attempts.
- Uploaded files and outbound messages pass through automated content and abuse screening.
How Ridgeline builds on top
Platform security is the floor — our engineering practices raise it.
- Every application we deliver is configured with least-privilege permissions per user role before launch.
- We never store payment card data ourselves; payments flow through PCI-certified processors.
- Client data is only accessed for agreed support and development work, and access is removed at handoff on request.
- Third-party integrations (QuickBooks, Google, Stripe and others) connect through OAuth — we never ask for or store your passwords to other services.
Transparency & ownership
Your data stays your data.
- You own all business data in your application and can export it at any time.
- Data is encrypted at rest but not end-to-end encrypted; platform administrators may access data for support and legal compliance under audited controls.
- Compliance reports, the DPA and the subprocessor list are available through the Base44 Security Trust Center.
- Questions about a specific requirement? We'll walk you through the details before you sign.
Need the audit reports?
SOC 2 reports, the Data Processing Agreement and the full subprocessor list are published in the platform's Security Trust Center.