Infrastructure & Trust
We are a platform that runs your business. You deserve to know exactly how it is built, where your data lives, who can see it, and what happens if something goes wrong. Nothing hidden.
Infrastructure
What runs Riff OS
Every third-party service we depend on, what it does, and why we chose it.
Global CDN. 99.99% uptime SLA. Auto-scaling. Zero cold starts on critical paths.
Branching, point-in-time recovery, daily automated backups, 30-day retention window.
Customer uploads (manuals, photos, documents) isolated per org. AES-256 at rest.
Card data never touches Riff OS servers. Square handles PCI DSS scope. We store no card numbers.
Enterprise-tier AI model providers, all under data processing agreements. All prompts scoped by org — no cross-tenant AI context leakage.
Bcrypt password hashing. Session tokens. No OAuth third-party dependency on critical auth path.
Bot management, DDoS protection, IP reputation filtering. Inventory data protected from scraping.
Real-time error tracking. API health pings every 60s. Owner console surfaces degraded services within 2 minutes.
Compliance
Regulatory posture
Music retail involves minors in lessons, card payments at POS, and California customers. Here is where we stand on every relevant regulation.
PCI DSS
Compliant — SAQ-A scope
Riff OS never stores, processes, or transmits raw card data. All payment flows are handled end-to-end by our PCI DSS Level 1 certified payment processor. Our responsibility is reduced to SAQ-A scope.
CCPA
Compliant
California residents can request export or deletion of their data at any time. Submit requests to privacy@riffos.io. We respond within 45 days per CCPA requirement. We do not sell customer data — ever.
COPPA
Age-gated at signup
Riff OS is a B2B business platform. All accounts require 18+ age acknowledgment at signup. Lesson student minor profiles are managed by the shop — parental consent responsibility lies with the account holder.
SOC 2
In progress — Q1 2027
Formal SOC 2 Type II audit is planned for Q1 2027. Current controls align with SOC 2 Trust Service Criteria for security and availability. Documentation available on request for enterprise accounts.
GDPR
US-based, GDPR not applicable
Riff OS is currently US-only. No personal data is transferred to or from the EU. If expansion into EU markets occurs, full GDPR compliance will be implemented prior to launch in those regions.
Data Ownership
Your data is yours. Period.
We have no business model that involves your data. We are paid to run software — that is the entire relationship.
Who owns my inventory, customer, and transaction data?
You do. Fully. Riff OS has zero claim on your business data. We are infrastructure — you own the content.
Can I export everything?
Yes. At any time, from the Owner Console, you can export your full data set as JSON — inventory, customers, tickets, invoices, deals, parts, team. No support ticket required.
What happens when I cancel?
Your account deactivates on the 1st of the following month. You have 30 days post-cancellation to export your data before it is purged. We will email you at 7 days and 3 days before purge.
Is my data used to train AI models?
No. Your org's data is never used to train any AI model — ours or our providers'. AI calls are scoped per org and are not retained beyond the active session by our gateway configuration.
Is my data shared with other shops on the platform?
No. Every query in the Riff OS database is scoped by org ID at the server-action level. There is no row-level security shortcut — it is enforced in code on every single data access.
Can other shops on the platform see my data?
No. Every query in the Riff OS database is scoped by org ID at the server-action level. No other shop can see your pricing, customers, margins, or transactions — ever.
AI & Data
How we handle AI
AI is embedded in every module. Here is the full picture of what goes in, what comes back, and what is never retained.
What gets sent to AI
- Your explicit query or command
- Relevant context from your org (inventory, tickets, deals)
- No data from other orgs — ever
- No payment card numbers — ever
- No passwords or auth tokens — ever
What AI providers receive
- Anonymized org context (no PII in default prompts)
- Session-scoped only — no persistent memory between sessions
- Governed by provider data handling agreements
- We use enterprise tiers — data not used for training
- Requests logged to our audit trail, not theirs
What is never done
- Your data used to train any AI model
- Cross-org AI context sharing
- AI making financial decisions without human confirmation
- AI accessing systems outside your org scope
- Vendor AI retention of your business data
SLAs & Commitments
What we promise
Published commitments. If we miss one, we will tell you first — not after you notice.
| Metric | Commitment | Notes |
|---|---|---|
| Platform uptime | 99.9% monthly | Measured across all API and UI surfaces |
| Checkout API uptime | 99.95% monthly | Critical path — payment processing |
| Database backup frequency | Continuous WAL + daily snapshots | 30-day retention |
| Point-in-time recovery | Up to 30 days | Per Neon tier |
| Incident response | P0: 1hr, P1: 4hr, P2: 24hr | Owner console alert surfaced within 2 min of detection |
| Data export SLA | Available on demand, 24/7 | No support ticket required |
| Payment failure grace period | 14 days | Account remains active, owner notified daily |
| Cancellation data retention | 30 days post-cancellation | Export window before purge |
Competitive Context
Why independent shops are leaving legacy platforms
Most music retail software was built before smartphones existed. The gaps in those platforms are exactly where Riff OS was designed.
| Category | Riff OS | Legacy platforms |
|---|---|---|
| Stack age | Built 2025 — cloud-native from day 1 | Legacy POS infrastructure from the 1990s–2000s |
| POS terminals | Floor-first mobile — close deals in any room | Fixed terminals — customers walked to a back-of-house kiosk |
| Customer data | Owned by each shop — portable, exportable, no lock-in | Vendor-controlled — shops have limited portability |
| AI integration | Native — every module has an AI Co-Pilot agent | None in front-line operations |
| Deployment | SaaS — live in hours, not months | Enterprise rollout — months of implementation |
| Pricing model | Flat-rate annual — no per-seat billing | Complex per-seat or per-terminal licensing |
| MAP compliance | Built in — real-time MAP enforcement per SKU per vendor | Manual enforcement — prone to override and error |
| Multi-module coverage | 12 modules in one platform — repair, lessons, rentals, consignment | Siloed tools — separate vendors for each department |
The honest take: Legacy platforms were not built for the way music retail works today — floor-first sales, repair queues, lesson studios, and consignment all under one roof. Riff OS was designed from scratch for exactly that operation.
Security
How we protect your data in transit and at rest
TLS 1.3 everywhere
All traffic — API, UI, webhooks — encrypted in transit. No HTTP fallback.
AES-256 at rest
Database and blob storage encrypted at rest by provider. Keys managed by Vercel + Neon HSMs.
Bcrypt password hashing
Passwords hashed with bcrypt before storage. We cannot recover your password — only reset it.
Per-org data isolation
Every DB query has a WHERE org_id = ? clause enforced at the server action layer. No RLS shortcut — code-level guarantee.
No client-side secrets
Cost basis, margins, approval limits, and AI prompts are never exposed to the browser. Server-only business logic.
Security headers
X-Frame-Options, X-Content-Type-Options, HSTS, CSP, Referrer-Policy, and Permissions-Policy set on every response.
Rate limiting
All public API endpoints rate-limited. Checkout endpoint capped per IP per minute. Brute-force auth attempts blocked after 10 failures.
Audit log
Every admin action (impersonation, data export, billing change, force-approve) writes an immutable audit record with actor, timestamp, and org context.
Dependency scanning
Automated dependency vulnerability scanning on every deploy. Critical CVEs block production deployment.
Contact
Questions about any of this?
If anything on this page is unclear, incomplete, or you need documentation for your own compliance review, reach out directly. We respond to security and compliance inquiries within 1 business day.