Last updated: October 4, 2026
This Privacy Policy explains how RootSystems ("we," "us," or "our") collects, uses, and protects personal data when you visit rootsystems.app or use our products: Offboarding Proof, Vendor Risk, HIPAA, Standards Readiness, AI Agent Trust (Agent Certificates, the Action Ledger and Named Sign-off, and Contract & Insurance Gap), and PQC Forge (together, the "Services"). One policy covers all of them.
RootSystems is an independent software business owned and operated by an individual in Tennessee, United States. Contact: hello@rootsystems.app.
Account information: your name, work email address, organization name, and password (stored only as a secure hash, never in plain text).
Content you add to the Services: questionnaire responses, assessment results, risk registers, vendor records, employee and contractor records, AI-agent profiles and certificates, and the reports generated from them.
Integration data: when you connect a system (such as Slack, GitHub, Microsoft 365 and Okta in Offboarding Proof), we read only what a check needs, such as whether a person's account is still active. We do not use this access for anything else.
Usage and security logs: login times, actions taken in the product, and technical data such as IP address and browser type, kept for security and troubleshooting.
Website contact form: your name, email address, and message. Stored messages are deleted automatically after 90 days.
Payment information: payments are handled by Dodo Payments, which acts as merchant of record. We never receive or store your full card details.
We do not ask for, and the Services are not designed to hold, special categories of personal data (such as health, biometric, or religious data). The HIPAA Compliance tool records your organization's safeguards and risks; do not enter patients' health information into it.
For people covered by the EU or UK General Data Protection Regulation (GDPR), we rely on these legal bases:
| Purpose | Legal basis |
|---|---|
| Creating your account and providing the Services you signed up for | Performance of a contract |
| Billing, tax, and accounting records | Legal obligation |
| Keeping the Services secure, preventing abuse, and fixing problems | Legitimate interests |
| Replying to messages sent through our contact form | Legitimate interests |
| Optional product news, where we ask you first | Consent (you can withdraw it at any time) |
We do not sell personal data, use it for advertising, or make decisions with legal or similarly significant effects about individuals by automated means. Scores and findings in our products are information for your organization to review.
We use a small number of service providers, each bound by contract to protect your data and use it only to provide their service to us:
| Provider | What they do for us | Location |
|---|---|---|
| Render | Hosts our applications and one database | United States (Oregon) |
| Neon | Hosts our databases (on Amazon Web Services) | United States (US West) |
| Vercel | Hosts the rootsystems.app website | United States / global edge network |
| Dodo Payments | Checkout, subscriptions, and tax as merchant of record | See Dodo Payments' own privacy policy |
| Support email (Gmail) and the fonts used on our website | United States | |
| Cloudflare | Routes email sent to hello@rootsystems.app to our support inbox | United States / global network |
We may also disclose data to legal authorities when required by a valid legal process, or to a successor in a merger or sale of the business, with notice to you where the law requires. We will update this list before adding a new provider that handles personal data.
Our Services are hosted in the United States. If you use them from the European Economic Area, the United Kingdom, or Switzerland, your data is transferred to the United States. We protect those transfers with the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, which are incorporated into our Data Processing Agreement.
No system is perfectly secure. If a personal data breach affects your data, we will notify you without undue delay.
Depending on where you live, you have the right to:
To use these rights, email hello@rootsystems.app. We will reply within one month. If your data was added to a product by your employer or another organization, we will pass your request to that organization, which controls it, and help it respond.
If you are in the EU or UK, you may also complain to your local data protection authority (in the UK, the Information Commissioner's Office). We would appreciate the chance to resolve your concern first.
United States residents: we do not sell or share personal information for cross-context behavioral advertising.
We use only essential cookies, to keep you signed in and to protect forms against forgery. We do not use advertising or analytics trackers. When you visit rootsystems.app, your browser loads fonts from Google Fonts, which receives your IP address to deliver them.
The Services are for businesses and are not directed at anyone under 18. We do not knowingly collect personal data from children.
If we make material changes, we will give reasonable notice (by email or in the product) before they take effect. The date at the top shows the latest version.
Questions about this policy or your data: hello@rootsystems.app.