RentBridge Docs

Security / Data Handling

Data Handling & Privacy

How RentBridge stores, processes, and protects your data.

Data Storage

Regions

All data is stored in US-region cloud infrastructure:

  • Database: Supabase (PostgreSQL, US region)
  • Application hosting: Railway (backend) and Vercel (frontend), US regions
  • Cache/queues: Upstash Redis, US region

Your data is processed and stored in the US.

Encryption

  • In Transit: TLS (HTTPS) on every connection
  • At Rest: AES-256 encryption at the database layer
  • Passwords: stored as salted one-way hashes — never recoverable as plain text
  • Payment data: tokenized and held by Stripe; card numbers never touch RentBridge servers

Data Retention

  • Active Data: Kept indefinitely while your account is active
  • Deleted Data: Securely erased within 30 days
  • Backups: Retained for 90 days
  • Audit Logs: Retained for 1 year (for compliance)

What Data We Collect

Required for Operations

  • Account: Email, password (hashed), company name
  • Fleet: Equipment names, photos, pricing, utilization data
  • Rentals: Customer names, contact info, equipment rented, dates, pricing
  • Payments: Payment method (tokenized by Stripe, not stored by us)
  • Maintenance: Service history, work orders, technician notes

Optional for Features

  • Telematics: GPS location, engine hours, fuel level, fault codes (if you connect Trackunit)
  • Inspections: equipment condition findings at checkout and return
  • Insurance: quotes and policies purchased per rental

Analytics & Improvement

  • Usage Data: Feature usage, page views, error logs (to improve RentBridge)
  • Performance Metrics: Load times, API response times

What We Don't Collect

We don't collect:

  • SSNs or government IDs (unless you provide them)
  • Full credit card numbers (Stripe tokenizes)
  • Medical or health information (unless specific to rental)
  • Biometric data (fingerprints, facial recognition)
  • Your location (unless you use telematics)
  • Browsing history outside RentBridge

Who Can Access Your Data

Within RentBridge

  • Your Team: only users in your organization, gated by role (owner, admin, member) — role checks are enforced at the API layer, and cross-organization access is blocked and covered by security regression tests
  • Support Team: only to resolve your issue
  • No one else: employees see only metadata (account created, subscription level)

Outside RentBridge

Your data is shared with:

  • Stripe: Payment processing (payment method, billing address, transaction data)
  • Telematics Providers: Only if you connect (equipment location, hours, etc.)
  • Email Service: Email delivery (customer contact info, message content)
  • Legal Authorities: Only if required by law (subpoena, criminal investigation)

Not shared with:

  • Advertisers (no ad targeting)
  • Data brokers (we don't sell data)
  • Third parties (without your consent)
  • AI training (your rental data doesn't train our algorithms)

GDPR Compliance

If your customers are in the EU, GDPR applies:

Customer Rights

  • Right to Access: Customers can request their data
  • Right to Deletion: Customers can request deletion (right to be forgotten)
  • Right to Portability: Customers can download their data
  • Right to Object: Customers can opt out of processing

How RentBridge Helps

  1. Privacy Policy: Transparent disclosures in your agreement with customer
  2. Data Deletion: deletion requests are handled via compliance@rentbridge.ai
  3. Data Export: customer rental history and spend data are exportable
  4. Processing Agreement: We act as a data processor for your customers

Your Responsibility: You must have a valid legal basis for collecting customer data (consent, contract, legitimate interest). Include privacy notice in your rental agreement.

CCPA Compliance

If your customers are in California, CCPA applies:

Customer Rights

  • Right to Know: Customers can request what data you have
  • Right to Delete: Customers can request deletion
  • Right to Opt-Out: Customers can opt out of data sale
  • Right to Non-Discrimination: Can't deny service for exercising rights

How RentBridge Helps

  1. Privacy Disclosures: Provide in your customer portal
  2. Data Access: Customers can request data export
  3. Data Deletion: Customers can request deletion
  4. No Sale: RentBridge doesn't sell customer data

Your Responsibility: Include CCPA disclosures in your privacy policy. Have a process for customer data requests.

Data Security Practices

Authentication

  • Passwords: hashed with a modern one-way algorithm
  • Session Tokens: short-lived JWTs (30-minute expiry) carrying organization and role
  • Rate Limiting: authentication endpoints limited to 10 attempts/minute to block brute force
  • 2FA: coming soon

Access Control

  • Role-Based: users see only data relevant to their role and organization
  • Audit Logging: sensitive actions logged with user + timestamp
  • Tenant Isolation: every query is scoped to your organization; isolation is covered by automated security tests

Infrastructure

  • Security Headers: HSTS, CSP, X-Frame-Options, and Referrer-Policy on every response
  • Error Tracking & Logging: Sentry plus structured JSON request logs with request IDs
  • Boot-Time Guards: production refuses to start with placeholder secrets or debug mode enabled
  • Patch Management: dependency security updates applied promptly

Incident Response

  • Detection: Automated monitoring 24/7
  • Containment: Immediate action on suspected breach
  • Notification: Affected customers notified within 24–72 hours
  • Remediation: Root cause fix + prevention measures

Data Backups

  • Automated backups at the database layer (Supabase), stored in US regions
  • Documented rollback procedures for application deployments
  • Formal RTO/RPO commitments will be published alongside SOC 2 certification (see SOC 2)

Your Data: Your Responsibility

RentBridge secures the platform, but you're responsible for:

  1. Customer Privacy: Include privacy notice in your agreements
  2. Legal Compliance: Comply with GDPR, CCPA, etc. in your jurisdiction
  3. Data Accuracy: Ensure customer data is correct (name, contact info)
  4. Backup: Export your data regularly for your own backup
  5. Access Control: Don't share your login; use strong passwords
  6. Team Training: Train staff on data security and privacy

Data Portability & Deletion

Export Your Data

You can export your data anytime:

  • CSV exports: rental history, spend analytics, and equipment performance (see CSV Import/Export)
  • Full-fidelity access: everything else via the REST API as JSON

No limitations — export whenever you want.

Delete Your Account

To delete your account and all associated data, email compliance@rentbridge.ai from your owner account with the subject "Account Deletion Request". We confirm the request, then securely delete your data within 30 days.

Note: Some data may be retained for legal/tax purposes (e.g., invoices for 7 years). Contact us for retention schedule.

Transparency & Accountability

We're committed to openness:

  • Privacy Policy: Available at rentbridge.ai/privacy
  • Terms of Service: Available at rentbridge.ai/terms
  • Data Processing Agreement: Available for enterprise customers
  • Subpoena Response: We notify you unless legally prohibited
  • Annual Reports: Published transparency reports (starting 2027)

Questions?

We take your data seriously. If you have questions, ask.

Last Updated: April 2026

Last updated: April 2026