Security

1. At a glance

• Rehearse runs on Amazon Web Services in the United States (us-east-1, N. Virginia).
• Data is encrypted in transit with TLS and encrypted at rest.
• Sign-in uses one-time email codes. There are no passwords to steal.
• On Rehearse for Teams, every request is limited on our servers to the caller’s own company, and checked against their role.
• Practice sessions aren’t recorded. Transcripts delete themselves after 30 days.
• We don’t have SOC 2 yet, or any other certification. More on that below.

2. Infrastructure and region

Our backend runs on Amazon Web Services in the us-east-1 (N. Virginia) region:

• API Gateway and Lambda run our API.
• DynamoDB stores accounts, sessions, feedback and Rehearse for Teams company data.
• Cognito handles sign-in for the app, the Teams portal and our internal admin tool.
• S3 stores files such as data exports, and hosts our internal admin tool.
• KMS holds the key used to encrypt sign-in codes in transit between our services.

Live sessions run over LiveKit, the conversation itself runs on OpenAI, and in avatar mode Anam renders the character’s face. This website and the Rehearse for Teams portal are hosted on Vercel. The full list is on our subprocessors page.

3. Encryption

• In transit: the app, the Teams portal and this website talk to our services over HTTPS (TLS). Live session audio is carried over encrypted connections.
• At rest: DynamoDB tables use AWS-managed encryption at rest, and our S3 buckets use server-side encryption (AES-256).
• Backups: our main database has point-in-time recovery, which keeps encrypted backups for up to 35 days.

4. Access control

Sign-in

Everyone signs in with a one-time code sent to their email. Each code works once and expires after a few minutes. The app, the Teams portal and our admin tool each have their own sign-in client.

Rehearse for Teams

• Company scoping on the server. Every Teams request is limited to the company on the caller’s own seat, which our servers look up from their verified sign-in. No request takes a company ID from the browser, so one company can’t reach another’s data, even by editing a URL.
• Role checks on every call. What a person can do — manage people, see insights, see billing, change settings — depends on their seat’s role (company admin, program lead or manager), and is checked on every request.
• Portal tokens only. The Teams API accepts only tokens issued to the Teams portal’s own sign-in client, so a token from the app or our admin tool can’t be used there. If that client isn’t configured, the API refuses every request rather than opening up.
• Limits built in. Transcripts and audio never leave our systems to a company. A shared rehearsal is a snapshot built from a fixed set of fields, not a copy of the record. Team breakdowns for groups of fewer than four people are dropped on the server, not just hidden on the page. The full list of what a company sees is in our Privacy Policy.

Our own staff

• Staff use an internal admin tool with role-based access: analytics, support, operations and owner. What each role can see is set out in our Privacy Policy.
• Sensitive actions, such as changing credits or plans, or suspending, exporting or deleting an account, are recorded in an audit log.
• API keys and other secrets are kept in managed secret stores, not in our code.

5. Recording

We don’t record practice sessions. Audio is streamed live so the character can respond, and isn’t stored by us. We keep the text transcript, which is deleted automatically after 30 days.

6. Retention

Deletion is automatic, using database time-to-live, and normally completes within a few days of these dates. People can delete their whole account at any time from the app or via Delete your account. Full details are in our Privacy Policy.

7. Subprocessors

We use a small number of providers, chiefly AWS (hosting and storage), OpenAI (the conversation, transcription and feedback), LiveKit (live audio and video), Anam (avatar faces), ohteapea (email delivery), RevenueCat and Layers (app subscriptions and analytics) and Vercel (website and portal hosting). OpenAI’s API terms state that data sent through its API isn’t used to train its models by default, and we don’t use customer conversations to train models. See the subprocessors page for what each one receives.

8. What we don’t have yet

We’d rather be plain about this than let you assume otherwise:

• We don’t have SOC 2 yet, and we don’t hold ISO 27001 or any other security certification.
• We haven’t had an independent penetration test.
• We don’t run a bug bounty program.
• We don’t yet offer single sign-on through your company’s own identity provider.

If your company needs a security questionnaire answered, email akil@rehearsenow.app and we’ll answer it honestly.

9. Reporting a security issue

If you think you’ve found a security problem in Rehearse, please email akil@rehearsenow.app with what you found, how to reproduce it, and what you think the impact is. Please don’t access other people’s data beyond what you need to show the problem, and give us a reasonable chance to fix it before telling anyone else.

We’ll acknowledge your report, keep you updated while we look into it, and tell you when it’s fixed. [to confirm: acknowledgment time, if we want to commit to one]