Enterprise procurement team? Request the full documentation package.
Security overview · pen test summary · controls documentation · DPA — available under NDA while SOC 2 audit completes (Q3 2026).
Security at a Glance
Security credentials
Every control listed below is active today — not on a roadmap.
CONTROLS IN PLACE TODAY
Every control below is active today — not on a roadmap.
Overview
Our security posture
Rolli is built on infrastructure designed to meet the security and reliability expectations of enterprise and institutional customers. We apply industry-standard controls across our platform including TLS 1.3 encryption in transit, AES-256 encryption at rest, role-based access controls, audit logging, and annual third-party penetration testing.
Rolli processes publicly available social media data only. We do not collect, store, or process private user data, private messages, or non-public content. This scope is deliberate — all evidence behind Rolli IQ's authenticity scores is publicly verifiable, which matters for enterprise teams whose procurement requires reproducible methodology.
For procurement reviews, enterprise customers can request an interim documentation package (security overview, pen test executive summary, controls documentation, DPA) while our SOC 2 Type II audit completes in Q3 2026. Contact security@rolli.ai.
Compliance
Compliance frameworks
SOC 2 Type II
Active audit — Q3 2026Active audit underway — target completion Q3 2026. Controls are aligned to the SOC 2 Trust Service Criteria (Security, Availability, Confidentiality). Enterprise customers can request an interim documentation package under NDA while the audit completes.
Contact security@rolli.ai to request the interim package: security overview, pen test summary, and controls documentation.
GDPR & CCPA
DPA AvailableData Processing Agreement (DPA) including Standard Contractual Clauses (SCCs) is available for enterprise customers. CCPA: Rolli does not sell or share personal information for cross-context behavioral advertising.
Email legal@rolli.ai to request a DPA or to exercise data subject rights.
ISO 27001
2026 RoadmapISO 27001 certification is on the 2026 product roadmap. Current security controls are aligned with ISO 27001 domains.
Contact us for current certification timeline.
SOC 2 Type II audit in progress with a Big Four accounting firm. Expected completion: Q3 2026. Security questionnaire (CAIQ), architecture overview, and sub-processor list available immediately under NDA. Request documentation →
What This Means For You
What our certifications mean for you
SOC 2 Type II (In Progress)
Annual third-party audit of our security controls. Expected Q3 2026. Summary available under NDA to qualified enterprise customers. Controls aligned to SOC 2 Trust Service Criteria: Security, Availability, and Confidentiality.
GDPR Compliant
All EU customer data processed under GDPR Article 6. Data Processing Agreements available including Standard Contractual Clauses. Sub-processor list published. Contact legal@rolli.ai for your DPA.
TLS 1.3 + AES-256
All data encrypted in transit (TLS 1.3) and at rest (AES-256 with 90-day key rotation). Zero plaintext storage of sensitive data. HSTS enforced across all endpoints. Older TLS versions rejected.
Encryption
Data encryption
In transit
All data in transit is encrypted using TLS 1.3. API endpoints are served exclusively over HTTPS. Older TLS versions are not accepted. HTTP Strict Transport Security (HSTS) is enforced.
At rest
Data stored in Rolli infrastructure is encrypted at rest using AES-256. Encryption keys are managed through our cloud provider's key management service with automatic rotation.
ACCESS CONTROLS
Enterprise-grade access management for teams and API consumers.
Data Handling
Data handling & retention
Full retention schedule and deletion procedures available upon request. Contact security@rolli.ai.
Sub-processor list
Full sub-processor list with DPA details available upon request to qualified prospects. Contact security@rolli.ai.
Security
Vulnerability management & responsible disclosure
Responsible disclosure
If you discover a potential security vulnerability in Rolli, please report it directly to our security team. We commit to acknowledging reports promptly and keeping you updated through the resolution process.
security@rolli.aiSecurity testing
Rolli conducts an annual third-party penetration test of its infrastructure and application layer, in addition to ongoing internal security reviews. Penetration test executive summaries are available to enterprise customers under NDA. Contact security@rolli.ai for the most recent assessment date.
ROADMAP
Where we are, what's coming, and how to request full documentation.
SOC 2 Type II
Q3 2026SOC 2 Type II audit is currently in progress. Expected completion: Q3 2026. Enterprise customers can request an interim documentation package under NDA — contact security@rolli.ai.
Data Retention
ActiveCustomer data is retained for up to 12 months. Deletion requests are processed within 48 hours of account closure or on request. Contact security@rolli.ai to initiate deletion.
Pen Testing
AnnualAnnual third-party penetration testing of infrastructure and application layer. Last test: Q4 2025. Executive summary available to enterprise customers under NDA — contact security@rolli.ai.
Availability
Uptime & SLA
Live uptime and incident history at status.rolli.ai. Enterprise SLA terms available on request — contact your account representative or security@rolli.ai.
Enterprise Procurement
Procurement fast-path checklist
The items below represent the most common requests from enterprise procurement and legal teams. Items marked 'Available' can be accessed directly or upon request.
The items below represent the most common requests from enterprise procurement and legal teams. Items marked "Available" can be accessed directly or upon request. Items marked "On request" require contacting our security team.
Enterprise Pathway
Pre-SOC-2 Enterprise Pathway
SOC 2 Type II certification is in progress (expected Q3 2026). While we complete certification, enterprise procurement teams can access the following directly — no waiting required.
Security Questionnaire (CAIQ)
Completed Cloud Security Alliance Consensus Assessment Initiative Questionnaire — ready for your procurement team.
Request Questionnaire →Pen-Test Coordination
Available to coordinate third-party penetration testing for enterprise prospects. Executive summary of our most recent test available under NDA.
Schedule Review →Architecture Review (NDA)
NDA-protected architecture review call with our security team. Covers infrastructure, data flows, access controls, and encryption model.
Request Architecture Review →Request security documentation
For procurement reviews, DPA requests, penetration test summaries, or any security question, email us directly or use the contact below. We aim to respond within 1 business day.
Security & Compliance Team
security@rolli.aiResponses within 1 business day. For urgent security disclosures, include "[SECURITY]" in your subject line.
Architecture
Security architecture
Technical controls in place today, documented for security reviewers and procurement teams.
Talk to a reference customer
We'll connect you with a security or comms team using Rolli in a similar context to yours.
Data Promise
Our customer data commitment
Three things we commit to, unconditionally, for every customer on every plan.
Your data is never sold
We do not sell, rent, or share your data with third parties for any commercial purpose. Your data is used exclusively to provide you the Rolli service.
Full deletion within 48 hours
You can request complete deletion of your data at any time. We process deletion requests within 48 hours of account closure or on written request to security@rolli.ai.
We monitor platforms — not you
Rolli monitors public social media content so you can understand the information environment. We do not monitor your private communications, internal systems, or personal accounts.
Security
Responsible disclosure policy
We take security seriously. If you discover a vulnerability in Rolli's systems, please report it responsibly. We commit to working with you transparently and promptly.
Respond within 48 hours
We acknowledge all security reports within 48 hours of receipt and provide a timeline for investigation.
Fix critical issues within 30 days
Critical vulnerabilities are prioritized for remediation. We commit to addressing confirmed critical issues within 30 days.
Credit reporters in our changelog
Security researchers who responsibly disclose vulnerabilities are credited by name in our public changelog, with their permission.
Report a vulnerability
Email security@rolli.ai with "[SECURITY]" in the subject line. Please include steps to reproduce, potential impact, and your contact information.
Common security & compliance questions
Is Rolli GDPR compliant?
Yes. Rolli processes data in compliance with GDPR Article 6 (lawful basis for processing). Rolli collects and processes only publicly available social media data — it does not process special category data or private personal information at scale. EU and EEA customers can request a Data Processing Agreement (DPA) including Standard Contractual Clauses (SCCs). Contact legal@rolli.ai.
Does Rolli store raw social media content?
Rolli stores metadata and analysis outputs — sentiment scores, authenticity scores, engagement metrics, and narrative classifications — rather than raw social media content. The full scope of data processing, retention periods, and deletion procedures is detailed in our Data Processing Agreement, available to enterprise customers on request.
Can Rolli support single sign-on (SSO)?
Yes. SAML 2.0 SSO is available on Team and Enterprise plans. Rolli supports integration with Okta, Microsoft Azure AD, Google Workspace, and other SAML 2.0-compliant identity providers. MFA is enforced for all admin accounts regardless of SSO configuration. Contact your account representative or security@rolli.ai to configure SSO.
Where is Rolli's infrastructure hosted?
Rolli's infrastructure is hosted on Amazon Web Services (AWS) in the United States. EU data residency options are available for enterprise customers with specific regulatory requirements — contact security@rolli.ai to discuss your requirements.
How does Rolli handle a security incident affecting customer data?
Rolli maintains a documented incident response plan. In the event of a security incident affecting customer data, we commit to notifying affected customers within 72 hours of confirmation — consistent with GDPR Article 33 requirements. The notification will include the nature of the incident, data affected, steps taken, and recommended actions for affected customers.
What is Rolli's vulnerability patch policy?
Critical severity vulnerabilities: remediation target within 72 hours. High severity: within 14 days. Medium severity: within 30 days. Low severity: addressed in the next scheduled release cycle. Our annual third-party penetration test results in a prioritized remediation plan that is tracked to completion.
Have a question not listed here? Email our security team — we respond within 1 business day.
Want to see Rolli in action before a procurement review?