Security & trustVerified inline paths refuse a send when evidence cannot be committed.
This applies only to explicitly routed, verified inline controls, not bypassed traffic or unverified paths. Pilot: up to 50 managed Windows 11 devices in Chrome; typed or pasted text in the signed-in ChatGPT composer. Excludes files, images, voice, other modes or responses, Edge, BYOD and other apps. Managed-device proof undated. Managed installation and ChatGPT composer interception have not yet been run on a managed Windows 11 endpoint. Dated proof is published before enrollment. For certification and attestation status, read the disclosures. For vulnerability reports, read the reporting instructions.
How we protect what you trust us with
The answers your security team will ask for during diligence.
Separate records, explicit retention
The audit record stores decision metadata, including the kinds of finding and the action taken, rather than prompt bodies. A separate employee activity store can retain encrypted content after mandatory hard-stop values are removed. Content access is role controlled and reads are audited. Operational retention defaults to 30 days, with a maximum of 90 days.
Your data is separated from every other customer’s
Separation is enforced by the storage itself rather than by software remembering to ask. If the system cannot establish whose data it is looking at, it returns nothing.
Unrecorded forwarding is refused on verified inline paths
If evidence cannot be committed, a verified inline control refuses the governed send rather than silently forwarding it. This applies only to explicitly routed, verified inline controls, not bypassed traffic or unverified paths.
Every part can do only its own job
Each component runs with the narrowest access it needs, and the system checks its own permissions before it will start serving. Too much access is treated as a defect, not a convenience.
Secrets never end up somewhere readable
Passwords and keys are never placed anywhere they could be picked up from a process list, a shell history or a log file. The system refuses to accept them that way at all.
Record changes are detectable
Changing or reordering an entry makes verification fail. A signed checkpoint also exposes removal of entries it covered, while the verifier reports when the newest entries are not yet covered.
How you check itDocuments for procurement
A draft pilot agreement with processing terms has been prepared for counsel review. It has not been reviewed by counsel, agreed or signed, and it must be reviewed and agreed before any enrollment. The data processing addendum is an internal draft, not counsel-reviewed or approved. Ask about their status before sharing more information; a request or approval does not replace agreed terms.
Before you share contact details
Email to support@redactwall.com sends your address, message and any attachments to Microsoft 365 for support and pilot inquiries. Only the owner, Eric, has access to that mailbox: its access list was verified on 2026-09-25, with no delegates, send-as grants or forwarding.
Contact records follow a retention schedule adopted on 2026-09-25, not yet reviewed by counsel. Support and pilot-inquiry email is deleted 24 months after receipt, enforced by an Exchange Online retention policy applied on 2026-09-25; the oldest message was received on 2026-08-24, so none reaches that age before 2028-08. A deleted message is then purged after Exchange's recoverable-items window. Auth0 keeps its own authentication logs for 1 to 30 days by plan; the plan on this tenant was not read back. Our streamed copy of those logs is deleted after 365 days by an enforced retention setting. Auth0 identities with no workspace and no sign-in for 24 months are removed at a quarterly review. Pilot request, requester, contact and approval records in the platform database have no deletion today: the database refuses to delete them because they anchor the identity audit chain, so they are kept for the life of the service. A backup set expires about 9 weeks after it is superseded, but new backups keep capturing the retained database records. Requests about your own data are answered within 30 days. The employee activity and training retention periods do not cover these records.
For an initial email, share only a brief, non-sensitive description. Keep organization and workflow details, customer records, credentials, prompt contents and attachments out of the initial message.
Read the contact-data noticePilot agreement
- What it is
- The written pilot scope, support responsibilities and term. The guided pilot is free; manual invoicing applies to paid conversion.
- Status
- Draft prepared for counsel review; not reviewed by counsel, agreed or signed. Must be reviewed and agreed before any enrollment.
- What it blocks
- Enrollment. No device is enrolled before the agreement is reviewed and signed.
Ask for its status in your pilot request, or write to support@redactwall.com.
Data processing addendum
- What it is
- The processing terms: purpose limitation, confidentiality and personnel, subprocessor flow-down and notice, return and destruction, incident notification inside your own reporting clock, and a right to audit.
- Status
- Internal draft only; not counsel-reviewed or available as approved terms.
- What it blocks
- Enrollment until the processing terms are reviewed and agreed.
Ask for its status in your pilot request, or write to support@redactwall.com.
Who supports the pilot, and when
- Assigned operator
- EricThe named person accountable for the pilot during its declared hours.
- Declared support hours
- Monday to Friday, 09:00 to 17:00 US Central (America/Chicago), excluding US federal holidays. First response within 1 business day. No on-call or out-of-hours coverage.Stated with an IANA time zone, so the hours mean the same thing on both sides of the agreement.
- If there is no response
- If there is no response within 2 business days, you may pause or cancel the pilot with no obligation.What you may do when the assigned operator does not answer.
Before you share contact details
Email to support@redactwall.com sends your address, message and any attachments to Microsoft 365 for support and pilot inquiries. Only the owner, Eric, has access to that mailbox: its access list was verified on 2026-09-25, with no delegates, send-as grants or forwarding.
Contact records follow a retention schedule adopted on 2026-09-25, not yet reviewed by counsel. Support and pilot-inquiry email is deleted 24 months after receipt, enforced by an Exchange Online retention policy applied on 2026-09-25; the oldest message was received on 2026-08-24, so none reaches that age before 2028-08. A deleted message is then purged after Exchange's recoverable-items window. Auth0 keeps its own authentication logs for 1 to 30 days by plan; the plan on this tenant was not read back. Our streamed copy of those logs is deleted after 365 days by an enforced retention setting. Auth0 identities with no workspace and no sign-in for 24 months are removed at a quarterly review. Pilot request, requester, contact and approval records in the platform database have no deletion today: the database refuses to delete them because they anchor the identity audit chain, so they are kept for the life of the service. A backup set expires about 9 weeks after it is superseded, but new backups keep capturing the retained database records. Requests about your own data are answered within 30 days. The employee activity and training retention periods do not cover these records.
For an initial email, share only a brief, non-sensitive description. Keep organization and workflow details, customer records, credentials, prompt contents and attachments out of the initial message.
Read the contact-data noticeWrite to support@redactwall.com. Declaration last checked 2026-09-25.
The rest of the trust file
What the pilot inspects, stores and keeps is set out in the privacy notice, and every service we run it on is named on subprocessors.
This site publishes no document it does not have, and no attestation nobody performed. Last reviewed 2026-09-25.
Reporting a vulnerability
Start with a minimal description, without customer data, credentials or attachments. Read the contact-data notice before sending a report.
Before you share contact details
Email to support@redactwall.com sends your address, message and any attachments to Microsoft 365 for support and pilot inquiries. Only the owner, Eric, has access to that mailbox: its access list was verified on 2026-09-25, with no delegates, send-as grants or forwarding.
Contact records follow a retention schedule adopted on 2026-09-25, not yet reviewed by counsel. Support and pilot-inquiry email is deleted 24 months after receipt, enforced by an Exchange Online retention policy applied on 2026-09-25; the oldest message was received on 2026-08-24, so none reaches that age before 2028-08. A deleted message is then purged after Exchange's recoverable-items window. Auth0 keeps its own authentication logs for 1 to 30 days by plan; the plan on this tenant was not read back. Our streamed copy of those logs is deleted after 365 days by an enforced retention setting. Auth0 identities with no workspace and no sign-in for 24 months are removed at a quarterly review. Pilot request, requester, contact and approval records in the platform database have no deletion today: the database refuses to delete them because they anchor the identity audit chain, so they are kept for the life of the service. A backup set expires about 9 weeks after it is superseded, but new backups keep capturing the retained database records. Requests about your own data are answered within 30 days. The employee activity and training retention periods do not cover these records.
For an initial email, share only a brief, non-sensitive description. Keep organization and workflow details, customer records, credentials, prompt contents and attachments out of the initial message.
Read the contact-data noticeSend reports to support@redactwall.com with SECURITY in the subject line, and to no other address. The machine-readable policy is published at /.well-known/security.txt.
Our commitments
- Acknowledgement within three business days, including whether we have reproduced the issue.
- A written outcome. A fix and its ship date, an accepted risk and its rationale, or a reasoned disagreement. Always an answer.
- Safe harbour for good-faith research. We will not pursue legal action for testing conducted against your own account or an installation you control.
- Coordinated disclosure. We request an embargo proportional to severity and will confirm when the fix ships. No indefinite embargo, and no NDA is required to submit a report.
- Credit at your discretion. Tell us the name to use, or ask to remain anonymous.
Testing boundaries
- Test only against your own account or an installation you control.
- No denial-of-service testing.
- Do not access, modify, or retain any record that is not yours.
Start a supervised pilot.
Work with RedactWall to confirm fit, agree the scope and verify one managed device before expanding.
- Inspected content stays out of evidence records
- Tenant data is isolated by storage boundaries
- Record changes are detectable within stated bounds