RodeoStat Security Overview

Effective September 17, 2026

Why this page exists

Associations and production companies asking whether to trust us with their data deserve a straight answer, not a sales call. This page describes how we protect information. If you need detail beyond what is here, email security@rodeostat.com.

1. Infrastructure

The Services are hosted on Amazon Web Services in the United States
Cloudflare provides DNS, TLS, DDoS mitigation, and bot management in front of the Services
Physical security, environmental controls, and hardware lifecycle are managed by AWS under its compliance programs (SOC 2, ISO 27001, and others)

2. Encryption and credentials

Layer	Protection
In transit	TLS for all connections; HTTP requests redirect to HTTPS
At rest	Primary data stores and backups reside on AWS managed storage with encryption at rest
Passwords	Stored as salted cryptographic hashes: never in plaintext, never recoverable
Secrets	API keys and credentials are managed outside of source code

3. Access control

Access follows least privilege: granted only where required
Multi-factor authentication protects administrative and cloud-console access
Administrative access is limited to a small number of individuals and is logged
Access is reviewed periodically and revoked promptly on role change
Customer data is segregated by account, with authorization checks at the application layer

4. Payment security

Payments are processed by Stripe, a PCI DSS Level 1 certified provider
We never receive, transmit, or store full payment card numbers. Card data goes directly from your browser to Stripe.
We retain only a payment token, card brand, last four digits, and expiration date
We are a PCI DSS SAQ A merchant

5. Application security

Dependencies are updated regularly, with security patches prioritized
Input validation, output encoding, and CSRF protections mitigate common web attack classes
Authentication and API endpoints are rate-limited, with bot and abuse mitigation at the edge
Uploaded files are size- and type-restricted before processing
Changes are tested before deployment

6. Monitoring and logging

Application and infrastructure logs are retained for operational and security purposes
Authentication events, administrative actions, and API access are logged
We monitor for error spikes and anomalous activity

7. Backups and recovery

Automated backups are taken on a rolling schedule and encrypted at rest
We maintain the ability to restore the Services from backup and periodically verify it

Recovery objectives are internal targets, not contractual commitments. Contractual commitments appear only in a signed Service Level Agreement.

8. Vendors and subprocessors

We review the security posture of vendors that process personal information on our behalf and bind them by contract.

Our current subprocessor list is published at rodeostat.com/legal/subprocessors. We provide 30 days' notice before adding a new subprocessor, and you can subscribe to change notifications from that page.

9. Incident response

We maintain an incident response process covering detection, containment, assessment, notification, and post-incident review.

If a security incident affects your personal information, we will:

Contain and investigate promptly
Notify affected customers without undue delay, and in any case within the timeframes required by applicable law
Notify regulators where required
Tell you what we know about what happened, what data was involved, and what we are doing about it

Contractual notification commitments, where applicable, appear in signed agreements and our Data Processing Addendum.

10. Where we are headed

Security work is never finished. Items on our roadmap include a third-party penetration test, a SOC 2 readiness assessment, documented access-review cadence, and single sign-on for organization accounts.

We do not currently hold SOC 2, ISO 27001, or equivalent certification. We would rather tell you that than imply otherwise.

11. Reporting a vulnerability

We welcome reports from security researchers and will not pursue legal action against anyone who reports in good faith under these guidelines.

Report to: security@rodeostat.com

Please include: a description of the issue, steps to reproduce, the affected URL or endpoint, and its potential impact.

Please do:

Give us reasonable time to fix the issue before public disclosure: we ask for 90 days
Use only accounts you own or have permission to test
Stop as soon as you have confirmed a vulnerability exists

Please do not:

Access, modify, or delete data belonging to others
Run denial-of-service or volumetric testing
Use social engineering, phishing, or physical attacks against our staff or vendors
Publicly disclose before we have had a chance to remediate

Our commitment: acknowledgment within 2 business days, a triage assessment within 7 days, and updates until resolution. We will credit you publicly if you would like. We do not currently operate a paid bug bounty program.

12. What we ask of you

Security is shared. Please:

Use a strong, unique password
Do not share your account credentials: this is also a violation of our Terms
Protect API keys and embed keys; never commit them to public repositories
Keep your devices patched and use device-level encryption, especially where RodeoStat caches data offline
Report anything suspicious to security@rodeostat.com

13. Limits

No system is completely secure. We work hard at this and we do not guarantee it. Nothing on this page creates a warranty or modifies our Terms of Service, including the disclaimers and limitations of liability in Sections 17 and 18 of those Terms.

14. Contact

security@rodeostat.com: vulnerability reports and security questions
privacy@rodeostat.com: data protection questions
legal@rodeostat.com: security questionnaires and contractual requirements

RodeoStat LLC
4764 W Integrity Way #238, Appleton, WI 54913, United States