Skip to content

Trust

How we keep Route Royal secure

Your clients, deals and documents live on Route Royal, so protecting them is part of the product. This is how we do it, and what we don’t claim yet.

Talk to us about securityReport a vulnerability

  1. A request from your team

  2. HTTPSEncrypted on the way
  3. Signed inWe know who is asking
  4. Your organisationIts own data, no one else’s
  5. PermissionsAllowed to do this?
  6. ValidatedEvery field checked
  7. Your dataAllowed

Checked at every stop, then let through.

Where we stand

Built to the standards, honest about the badges

We follow the frameworks below because they are good practice. Route Royal is not certified to ISO 27001 and has not had a SOC 2 audit. When that changes, this page will say so.

  • ISO/IEC 27001

    Our security policies and controls follow ISO 27001 and its Annex A: risk, access, suppliers, operations, incidents and continuity.

    Followed, not certified

  • SOC 2

    We work to the Trust Services Criteria for security, availability and confidentiality.

    Followed, not certified

  • GDPR

    We process personal data as a processor should: only on your instructions, under a data processing agreement, and with the rights of the people in it respected.

    Followed, not certified

  • OWASP Top 10

    We build the platform and its API against the most common web application risks.

    Followed, not certified

Principles

Six principles behind every decision

  1. 01

    Least privilege

    People, services and AI get only the access their job needs, and lose it when the job is done.

  2. 02

    Defence in depth

    No control stands alone. Encryption, permissions, validation and monitoring each back up the others.

  3. 03

    Secure by default

    The safe setting is the one you start with: HTTPS everywhere, keys stored only as hashes, and AI changes that wait for you.

  4. 04

    Privacy by design

    Each organisation’s data is kept apart, and we collect only what the service needs to run.

  5. 05

    People decide

    Q prepares the work, but nothing changes until the person asking confirms it.

  6. 06

    Openness

    We say what we do and what we don’t, and we tell you quickly when something goes wrong.

In practice

How we protect the platform

The controls behind those principles, area by area.

On this page
  1. Infrastructure
  2. Encryption
  3. Application security
  4. Our team
  5. Building and changing Route Royal
  6. Monitoring and response
  7. AI and your data

Infrastructure

  • Route Royal runs on established cloud providers whose data centres are certified to ISO 27001 and whose services are audited to SOC 2 Type II.
  • The data centres’ physical security, from controlled entry to round-the-clock monitoring, is run by those providers and covered by their audits.
  • Our database runs on a managed service with automated backups.
  • Production is kept apart from development and testing, and our services run as unprivileged users.

Encryption

  • Every connection to Route Royal uses HTTPS, and browsers are told never to connect any other way (HSTS).
  • Data is encrypted at rest by our database and storage providers.
  • Credentials you give us for connected services, such as your Sumsub token, are encrypted before they are stored.

Application security

  • Each organisation’s data is kept separate. Requests are checked against the organisation they are for and the permissions of the person making them.
  • API keys are stored only as hashes, with a short prefix so you can tell them apart. Publishable keys are read-only; secret keys stay on your server.
  • Webhooks are signed with a secret for each subscription (HMAC-SHA256), so you can check that they came from us.
  • Every request is validated, the API is rate limited, and browsers get strict security headers, including a content security policy.

Try it: what we keep of a key

What we store

Prefix
sk_demo_…
SHA-256 hash

Worked out in your browser, so nothing you type leaves this page. A hash can’t be turned back into the key, so not even we can read it.

Our team

  • Staff reach production systems and customer data only when their role needs it, and access is reviewed and removed when it no longer does.
  • Staff accounts are protected by multi-factor authentication.
  • Everyone on the team signs a confidentiality agreement and is trained in security when they join.
  • We look at your data only when you ask us to for support, or when we must to keep the service safe or meet the law.

Building and changing Route Royal

  • Changes are reviewed and tested before they reach production.
  • Every build checks our dependencies for known vulnerabilities and scans the code, and stops on critical findings. A weekly sweep catches new advisories.
  • We don’t copy customer data into development or testing.

Monitoring and response

  • Our services are traced and measured, and the team is alerted when something looks wrong.
  • Every sign-in goes into the person’s sign-in history, and single sign-on, directory sync and booking changes go into your organisation’s audit log.
  • When an incident happens we contain it, fix the cause and review what we learned. If it affects your data, we tell you without undue delay, with what we know, so you can meet your own obligations.

AI and your data

  • Q works as the person asking, within their permissions, and every change it makes waits for their confirmation.
  • Claude and ChatGPT, connected over MCP, have only the permissions of the person who connected them, and reach a client’s data only through an active service grant.

Try it: Q has prepared a change

Move 3 deals from Proposal to Won

Your side

Security you control

Security is shared. These are the settings your own organisation decides.

Security and compliance

Two-factor sign-in, single sign-on and directory sync, roles, service grants and the audit log.

AI and Q

What Q can do, and how Claude and ChatGPT connect, within each person’s permissions.

Developers

Publishable and secret keys, scoped API keys and signed webhooks for your own builds.

Responsible disclosure

Found a vulnerability?

Tell us at security@routeroyal.com. Include what you found, how to reproduce it and what it could affect. We’ll reply, keep you posted while we fix it, and credit you if you’d like.

security@routeroyal.com

While you look, please

  • test only against your own account and data
  • never read, change or delete anyone else’s data
  • not degrade the service, send spam or try to trick our people
  • give us reasonable time to fix the issue before you share it

Questions

What security teams ask us

Is Route Royal certified to ISO 27001 or SOC 2?

Not yet. We follow ISO 27001 and the SOC 2 Trust Services Criteria, but we have no certificate or audit report to share. Our hosting and database providers are certified and audited themselves.

Where is our data hosted?

With established cloud providers whose data centres are certified to ISO 27001 and audited to SOC 2. The companies that process your data are in our subprocessors list, and we can go through them with you in a security review.

Will you fill in our security questionnaire?

Yes. Send it to security@routeroyal.com and we’ll answer it, or walk your team through our controls on a call.

What happens if there is a security incident?

We contain it, fix the cause and review what happened. If it affects your data, we tell you without undue delay, with what we know so far, so you can meet your own obligations, such as the 72 hours GDPR allows for telling the regulator.

How do we secure our own organisation?

Turn on two-factor sign-in, connect single sign-on and directory sync, give each person the role their job needs, and check the audit log. Security and compliance shows how.

Documents

The paperwork behind it

Bring us your questions

Ask us anything about security

Reviewing Route Royal for your business, or found something we should fix? Each has its own way in, and both come straight to us.

Security reviews

Running a security review?

Your questionnaire

  1. Where is our data hosted?
  2. Who can see our data?
  3. What happens in an incident?
  1. We answer it
  2. Or walk your team through our controls on a call
Talk to us about security

Email us your questionnaire

Responsible disclosure

Found a vulnerability?

Your report

  1. What you found
  2. How to reproduce it
  3. What it could affect
  1. We reply
  2. We keep you posted while we fix it
  3. We credit you, if you’d like
security@routeroyal.com

Start a reportsecurity.txt