Security at RP Wellness
How we protect the information you trust us with.
Last Updated: August 12, 2026
We are not certified, and we do not claim to be.
This page describes the security practices we operate today. It is not an audit report and not a certification. A SOC 2 report can be issued only by a licensed CPA firm, and ISO 27001 certification only by an accredited certification body. We hold neither. We maintain an internal control register modelled on both frameworks, and we will say plainly when that changes.
Protecting data in transit and at rest
All traffic to our storefront and APIs is served over TLS. Calls to our processors — payments, email, SMS, shipping and screening — are made to HTTPS endpoints only.
Application secrets and third-party credentials are held in our platform's secret store and are readable only by server-side code. No secret is present in the browser.
Access control
Access follows least privilege under a written access control policy. Authentication is handled by our platform's managed identity layer — the application never handles or stores passwords itself.
Every record enforces server-side access rules: customer records are scoped to their owner, and workforce, financial and compliance data are restricted to administrators. These rules are enforced on the server, so they cannot be bypassed from a browser.
Access is granted through onboarding and removed on the last day worked, recorded alongside equipment return.
How we handle sensitive information
We do not store complete card details. Payments are tokenized by Stripe, and card data never reaches our database.
We do not store full taxpayer identifiers — only the last four digits, with the signed form retained as a document. Background-check identifiers are entered by the candidate on the screening provider's own hosted page and never pass through our systems.
Information is classified as Public, Internal, Confidential or Restricted, with handling rules attached to each level and a named owner for every data store.
Monitoring and audit trail
Administrative and system actions write to a central activity log recording who acted, what changed, and when. Older entries are archived rather than discarded.
Application errors are captured continuously, and a scheduled health check runs against core functions.
Order risk analysis, spam-order scanning and a server-enforced IP blocklist operate at checkout to detect fraud and abuse.
If something goes wrong
We maintain a written Incident Response Plan with four severity levels, named response roles, and a defined sequence that puts containment ahead of investigation.
The plan sets out our notification duties — to affected individuals, our payment processor, vendors and regulators — and the timelines that apply to each.
People
Background screening is completed before a worker is engaged, proportionate to the role, with results recorded on their onboarding file.
Security responsibilities are set out in a written acceptable use and device security policy.
Change management
Changes are version-controlled with author and timestamp. Changes touching checkout, payouts, payroll or access rules carry an additional review that specifically checks whether any value affecting money or access could be supplied by the browser.
What we are still working on
We run a small operation, and some practices that a larger company would separate across several people currently sit with one. We compensate for that with a complete activity log and an additional review step on high-risk changes, and we record the concentration openly in our own register rather than presenting it as resolved. We are also working through independent review, formal vendor agreements, and proving our recovery procedures by testing them.
Reporting a security concern
If you believe you have found a vulnerability, or you think your account or data may have been affected, contact us at support@rpwellness.store with the subject line “Security”. Please give us the detail needed to reproduce the issue and allow us reasonable time to investigate before disclosing it publicly.
Business customers and partners may request our written security policies. Documents we have marked shareable — including our Access Control Policy and our Vendor & Subprocessor Register — are available on request through the same address.