Rebulk is the operating system for bulk materials: inventory measurements, railcar records, scale tickets, and billing data that facilities run their operations on. That data deserves real protection. This page describes how we secure it.
Isolated Databases Per Customer
Each customer organization's operational data lives in its own dedicated database. This is physical isolation, not a shared table with a customer column: your inventory, measurements, railcars, and billing records are stored in a database that contains no other customer's data. A query for one organization cannot return another organization's rows, because the other organization's rows are not in the same database.
Encryption
- All traffic between your browser, our edge devices, and our platform is encrypted in transit with TLS.
- Credentials for connected third-party services (for example, QuickBooks Online access tokens) are encrypted at rest with AES-256-GCM using dedicated encryption keys, managed separately from application secrets.
File Storage
Documents and imagery (bills of lading, scale tickets, scan captures) are stored in dedicated, access-controlled object storage. Nothing is publicly readable: every file is scoped to its owning organization, and access is served through time-limited signed URLs issued only to authenticated users of that organization. Each deployment of the platform uses its own isolated storage, separate from every other deployment.
Access Control
Access inside the platform is role-based and explicitly granted. Administrators control who belongs to their organization, and can scope a person's access down to specific sites or workspaces with viewer, editor, or admin roles. Financial surfaces (invoicing, billing, accounting integrations) carry an additional access lane that can be withheld from operational users entirely. Grants are individually auditable: every permission a person holds is a record an administrator can see and revoke.
Rebulk's Access to Your Data
Access to production systems is restricted to a small number of authorized Rebulk personnel and protected by key-based authentication. Inside the platform, Rebulk staff access requires a designated administrative role that ordinary accounts cannot obtain, and we use it to operate, support, and improve the service, not to browse customer data. Partner and reseller access is never implicit: it works through the same explicit, auditable grants as any other user.
Connected Integrations
When you connect a third-party service such as QuickBooks Online, the connection is authorized through the provider's own OAuth flow: Rebulk never sees or stores your password for that service. We exchange only the data needed to provide the integration, at your direction. Disconnecting revokes Rebulk's access with the provider itself, not just on our side.
Backups & Continuity
Databases are continuously replicated off-site, so recovery points are measured in seconds rather than in daily snapshots. Every customer database is included in replication, not just central application data.
How We Build
Every change to the platform passes an automated test suite covering both deployment modes before it can ship, and changes touching financial or billing code additionally go through independent adversarial review before merge. Releases roll out with health checks: a build that fails to start never replaces the running version, and databases are never migrated by hand.
What We Don't Do
- We do not sell customer data.
- We do not process or store payment card data on our platform.
- We do not share customer data with third parties without consent, except as required by law.
Reporting a Vulnerability
If you believe you have found a security issue in Rebulk, please email founders@rebulk.com with enough detail to reproduce it. We will acknowledge your report promptly, and we ask that you give us a reasonable window to remediate before public disclosure.