# Data security is our top priority [View Security Whitepaper](https://rippling2.imgix.net/PM_WP_Security-Program.pdf) [Learn more about privacy](https://www.rippling.com/privacy-compliance) ## We take phishing and spoofing emails very seriously. If you receive a suspicious email you think may not be from Rippling, report it immediately by forwarding to [report-abuse@rippling.com](mailto:report-abuse@rippling.com). Note: this is an automated service, you will not receive a reply. ## Security tools you can trust Rippling combines enterprise-grade security features with regular audits to ensure you’re always protected. ### Compliance Rippling meets industry-standard compliance—SOC, CSA, and ISO. ### Infrastructure Industry best practices inform all of Rippling’s services. ### Personnel Every Rippling employee is vetted and trained on strict security policies. ### App and development Rippling products are built with security and quality top-of-mind. ## We comply with global data protection and security frameworks Rippling complies with all applicable privacy and data protection laws, including GDPR and CCPA. Learn more about our approach to privacy [here](https://www.rippling.com/privacy-compliance). ### SOC 1 Type ll Rippling’s SOC 1 Type 2 report covers 11 different control areas from information security and operations to change management and payroll processing, and is audited annually. ### SOC 2 Type ll Rippling's SOC 2 Type 2 report covers the trust services categories of Security, Confidentiality, and Availability, and is audited annually. ### SOC 3 Rippling's SOC 3 report is a publicly available version of our SOC 2 that covers the same trust services criteria. [Download our SOC 3 here](https://rippling.imgix.net/images/Rippling-2023-Type-2-SOC-3-Final-Report.pdf). ### CSA STAR Level 2 Rippling has achieved CSA STAR Level 2 certification, demonstrating independent third-party validation of its security controls against the Cloud Security Alliance (CSA) Cloud Controls Matrix (CCM). ### ISO 27001 Certified Rippling's ISO 27001 certification demonstrates our commitment to operating a mature security program. ### ISO 27018 Certified Rippling's ISO 27018 certification demonstrates our commitment to protecting personal information of our customers. ### ISO 42001 Certified Rippling’s ISO 42001 certification demonstrates our commitment to secured and governed AI management. ## We're built to secure your most sensitive data ### Secure infrastructure provider All data is housed in physically secure, US-based AWS data centers across multiple availability zones. ### Data redundancy and resiliency Rippling leverages robust and scalable cloud computing platforms and adheres to configuration best practices to ensure best-in-class resiliency. ### Formal security policies and incident response plan Rippling maintains comprehensive security policies. These materials are reviewed by all employees during periodic training. ### Strict onboarding and offboarding process Every new employee must pass a thorough background check and must complete a suite of privacy and security training courses. We instantly disable departing employees' devices, apps, and access during offboarding via Rippling's IAM and MDM products. ## Personnel security ### Formal security policies and incident response plan Rippling maintains a set of comprehensive security policies that are kept up to date to meet the changing security environment. These materials are made available to all employees during training and through the company’s knowledge base. ### Strict onboarding and offboarding process Every new joiner must pass a thorough background check and attend a "Legal and Security" training course, as well as an InfoSec training course once a year. We instantly disable departing employees’ devices, apps and access during offboarding via Rippling’s IDM and MDM products. ### Continuous security training The Rippling Security Team provides continuous education on emerging security threats, performs phishing awareness campaigns, and communicates with employees regularly. ### Office security Rippling manages visitors, office access and overall office security via a formal office security program. ## App and development ### Penetration testing and bug bounties We partner with reputable security firms to regularly run internal and external pen tests. Additionally, our bug bounty program allows anyone to test our system and report bugs. ### Application monitoring and protection All app access is logged and audited. We also use a wide variety of solutions to quickly identify and eliminate threats, including a Web App Firewall (WAF) and Runtime App Self Protection Agent (RASP). ### Development and change management process Code development is done through a documented SDLC process, and every change is tracked via GitHub. Automated controls ensure changes are peer-reviewed and pass a series of tests before being deployed to production. ### Third-party vendor security review process We ensure that all our third-party apps and providers meet our security data protection standards before using them. >“Rippling is building one of the most important business systems of record for the modern company. When a platform becomes that central to how organizations operate, security cannot be a layer added later. It has to be foundational to the architecture. My focus is to make world-class security an invisible, reliable constant for every customer, so they can move faster with complete confidence.” >Adrian Ludwig >Chief Security Officer at Rippling ## Dig deeper into our security posture ### Security spotlight Amanda Perry People and Operations Manager at NuvoLogic Consulting ### High-growth Morning Consult uses Rippling to run lean and remain a top place to work Rippling helped Morning Consult add hundreds of employees and subtract hundreds of hours of manual administrative work. - 2 managers for payroll, benefits, and devices for 500 employees - 500 hours saved onboarding, offboarding, and reporting - 500 employees ### Chess.com creates frictionless people processes with a unified platform With key information about their workforce split across multiple places, the team recognized the need for scalable people processes to support their rapid growth. - 60+ countries unified under one system - 700+ hires onboarded with automated provisioning ### Superhuman cuts employee onboarding in half with Rippling With Rippling, Superhuman has reduced time spent on HR and IT tasks by 75%. - 75% reduction in time spent on HR and IT tasks - 15 admin hours saved per month