Rierino LogoMenu

Security at Rierino.

Enterprise-grade security built into every layer of the platform, deployment that stays inside your own infrastructure, and a track record proven across regulated environments.

Rierino Hero

OUR APPROACH TO SECURITY

Rierino’s security model combines certified information security governance, secure software development, granular identity and access controls, encryption, continuous observability, and customer-controlled deployment. Enterprise customers can run Rierino in public cloud, private cloud, on-premises, bare metal, or sovereign and air-gapped environments where required, keeping application data and runtime infrastructure within their chosen security, data residency, and regulatory boundaries.

This approach gives organizations control over where their systems run, how data is accessed, and how security integrates with their existing enterprise architecture. The sections below describe the governance, people, platform controls, development practices, infrastructure safeguards, monitoring, incident response, and business continuity measures that support Rierino deployments.

ISO/IEC 27001:2022 CERTIFIED

Rierino's information security management system is certified to ISO/IEC 27001:2022, the international standard for managing information security risk. The certification (No. 2026/ISMS/002662) is independently audited and accredited by IAS (International Accreditation Service). It covers Rierino's product development and client implementation functions: the people, processes, and technology used to build the platform and deliver it to clients.

HOW RIERINO PROTECTS YOUR DATA

GOVERNANCE

Rierino's ISMS operates under a documented Information Security Policy, reviewed and approved by executive leadership at least annually. Risk is assessed formally at least once a year, and after any significant change, with results feeding a structured treatment plan. Internal audits and management reviews check the system's effectiveness on a fixed schedule, not on an ad hoc basis.

PEOPLE

Personnel are screened before joining, with enhanced vetting available where a client engagement requires it, and bound by confidentiality obligations that extend beyond employment. Security awareness training is mandatory at onboarding and annually thereafter, with a completion target above 98%. Developers complete secure coding training aligned to OWASP, and all staff complete training modeled on SOC 2 Trust Services Criteria, covering security awareness, data handling, and incident reporting.

ACCESS CONTROL AND IDENTITY

Access is governed by role-based and attribute-based access control (RBAC and ABAC), fully customizable per deployment so permissions can be scoped as precisely as a client's own policy requires, down to attributes like region, department, or data classification. Enterprise identity providers are supported through SSO (SAML/OIDC) and LDAP connectors, with configurable multi-factor authentication. Access rights are reviewed on a fixed schedule to keep permissions current and eliminate unused accounts.

APPLICATION AND DEVELOPMENT SECURITY

The platform is built under a documented secure development lifecycle: secure-by-design architecture principles, mandatory secure coding standards, code review, and dependency and security testing before every release. Source code access is restricted and change-controlled, and development, test, and production environments are kept separate. Every release is required to pass its security gates before shipping.

INFRASTRUCTURE AND DEPLOYMENT

Rierino deploys on public cloud, private cloud, on-premises, or bare metal, across AWS, Azure, GCP, Oracle, Huawei, and more, on VMs, Kubernetes, Docker, or bare metal. Because clients choose and own the infrastructure their deployment runs on, the physical and platform security of that environment stays under their control and their existing accreditations. Rierino's certified practices govern how our people, code, and tooling access and protect data within it. Data is encrypted in transit and at rest.

MONITORING, LOGGING, AND INCIDENT RESPONSE

Every deployment produces a full audit trail: access and security events are logged separately from general application logs, request tracing runs across services, and change data capture gives a real-time view of what changed and when. Logs, traces, and metrics stream automatically to any OTLP-compatible monitoring platform, so a client's own APM stays the single pane of glass. Log retention is configurable to meet a client's own data minimization requirements.

Security incidents are managed through a documented response process, with clients and regulators notified within contractual and legal deadlines. Vulnerabilities are triaged and remediated against a fixed timeline. Responsible disclosure reports can be sent to hello+security@rierino.com.

BUSINESS CONTINUITY

Business continuity and disaster recovery are governed by documented plans designed to maintain critical operations and restore services following a disruption. Recovery procedures are validated through regular backup restore exercises rather than assumed to work when needed, and continuity plans are reviewed periodically and after significant changes to systems or operations.

BUILT FOR HIGH-STAKES ENVIRONMENTS

Rierino is built for organizations where security, reliability, data control, and operational continuity are critical. Its deployment model supports regulated industries, public sector organizations, large-scale commerce, and other complex enterprise environments, including cases where infrastructure, data residency, access, and monitoring must remain under the client's control. This approach has been proven across demanding production environments, with a security track record that remains incident-free to date.

A NATIONAL GOVERNMENT MINISTRY

Rierino has been deployed in a fully air-gapped, sovereign environment within government-controlled infrastructure. The implementation includes role-based access control (RBAC), comprehensive audit trails, identity integrations, and offline continuity. It has undergone independent penetration testing by multiple third-party security firms as well as the national cybersecurity authority, with continuous monitoring by the client's own security operations center (SOC).

See the Government Tech case study →

A NATIONAL GOVERNMENT AUTHORITY

For a national government ministry, Rierino has been deployed entirely within the government's federal network, with application workloads and data remaining inside government-controlled, on-premises infrastructure. The deployment integrates with national digital identity and existing enterprise systems while supporting granular access control, governed onboarding, administrative approvals, and auditable data flows.

See the Smart Government case study →

A GLOBAL PAYMENTS NETWORK

In a global payments environment, Rierino has been implemented in a private, in-country cloud supporting sensitive financial operations across a multi-organization ecosystem. The deployment combines role-based access, encryption, audit logging, controlled data movement, and automated validation while meeting the client's requirements for data residency, confidentiality, traceability, and regulatory compliance.

See the Financial Services case study →

COMPLIANCE ACROSS MARKETS

Rierino is built to support the data protection and privacy requirements that matter to enterprise and public sector organizations, including GDPR, Türkiye's KVKK, Saudi Arabia's PDPL, and the UAE's PDPL. Flexible deployment, including on-premises, private cloud, sovereign, and in-country environments, helps organizations address data residency and sovereignty requirements without giving up control of their infrastructure.

Configurable controls for data access, retention, encryption, logging, and residency allow each deployment to align with the regulatory requirements and internal policies of the markets and organizations it serves, rather than imposing a single compliance model.

If you have questions about Rierino’s security practices, certifications, deployment models, or how the platform can align with your organization’s security and compliance requirements, please contact us at hello+security@rierino.com.

FAQs

Your top questions, answered. Need more details?
Our team is always here to help.

Talk to an Expert →

Is Rierino ISO 27001 certified?

Yes. Rierino's Information Security Management System (ISMS) is certified to ISO/IEC 27001:2022 (certificate No. 2026/ISMS/002662). The certification body is accredited by IAS (International Accreditation Service).

How is Rierino deployed?

Rierino is designed for customer-controlled deployment. Clients can deploy the platform in public cloud, private cloud, on-premises, or bare metal environments using infrastructure and regions of their choice, including AWS, Azure, GCP, Oracle, and Huawei.

Can Rierino be deployed in sovereign or air-gapped environments?

Yes. Rierino supports sovereign, isolated, and fully air-gapped deployment models and has been deployed in air-gapped environments for national government organizations. These deployments can operate entirely within customer-controlled infrastructure without relying on externally hosted Rierino services.

How does Rierino support data residency and data sovereignty?

Because clients control where Rierino is deployed, application workloads and data can remain within selected countries, regions, private clouds, or on-premises environments. This allows organizations to align deployment architecture with their own data residency, sovereignty, and regulatory requirements.

Does Rierino support GDPR, KVKK, and regional data protection laws?

Rierino is built to support the requirements of GDPR, Türkiye's KVKK, Saudi Arabia's PDPL, the UAE's PDPL, and other applicable data protection frameworks. Configurable controls for data residency, retention, access, encryption, and logging allow deployments to align with organizational and regulatory requirements.

Does Rierino support role-based and attribute-based access control?

Yes. Rierino natively supports both role-based access control (RBAC) and attribute-based access control (ABAC). Permissions are customizable by deployment and can incorporate attributes such as region, department, role, or data classification.

Does Rierino support single sign-on and enterprise identity providers?

Yes. Rierino supports enterprise identity providers through SAML- and OIDC-based single sign-on (SSO), as well as LDAP connectors. Multi-factor authentication can also be configured according to the client's identity and access policies.

How does Rierino protect data in transit and at rest?

Data is encrypted both in transit and at rest. Because deployments run within customer-selected infrastructure, encryption and key management can also align with the security controls and policies of the underlying environment.

What security logging and monitoring does Rierino provide?

Rierino provides comprehensive audit trails, dedicated access and security event logging, distributed request tracing, metrics, and change data capture. Logs, traces, and metrics can be streamed to OTLP-compatible observability and security platforms, allowing clients to integrate Rierino into their existing monitoring, APM, and security operations workflows.

Is Rierino penetration tested?

Rierino deployments have undergone independent penetration testing in high-security customer environments. In one sovereign government deployment, testing was performed by multiple independent security firms as well as the relevant national cybersecurity authority.

How does Rierino handle vulnerabilities and security incidents?

Vulnerabilities are triaged and remediated against a fixed timeline. Security incidents are managed through a documented response process, with client and regulator notification within contractual and legal deadlines.

How do I request Rierino's security documentation?

For security documentation, security questionnaires, certification information, or other security-related inquiries, contact hello+security@rierino.com.