Confidentiality
How we work inside your systems.
This isn’t a compliance badge page. Riftmark holds no certifications and claims none. Here is how the work is set up, which is what matters when the systems hold your client relationships.
Last updated
Draft for review. David has not had this page reviewed by counsel. It is not legal advice, and it is not a certification. It describes how the work is set up today.
Working in your data
- Least access, in writing
- We ask for the narrowest access that lets the work happen, usually an export or a scoped view of open proposals. What we can reach is agreed in writing before work starts.
- What we ask for, and what we don’t
- One export of open opportunities: client, project, fee, close date, last touch and owner. For ongoing work, a refreshed export or a scoped read-only view. Never passwords, shared logins, or permission to send in your name.
- Exchanging files
- Exports move through the secure file share your firm already uses, or one agreed in writing.
- No blanket mailbox access
- We don’t ask for access to anyone’s whole inbox.
- A person reviews everything client-facing
- Every draft is read by a person before it reaches your team, and your team decides whether it goes out at all.
- Your CRM stays the record
- We work from your records and hand the work back into them. We don’t keep a shadow copy of your pipeline as the source of truth.
- Access ends with the engagement
- When the work stops, access is revoked and working copies are removed.
This website
- HTTPS everywhere
- Served over TLS, with HTTP Strict Transport Security.
- A strict Content Security Policy
- Scripts load from this site. If you allow analytics, the analytics script loads from Google. Other sites can’t frame these pages. This site does not embed a scheduler.
- No advertising or tracking
- No ad pixels and no cross-site advertising. Analytics loads only after you allow it, and not otherwise.
- Forms without a custom backend
- Forms are processed by our host, with spam filtering. There are no credentials in front-end code.
- Self-hosted
- Fonts and the case study are served from this site, not from third-party CDNs.
What we don’t claim
Riftmark holds no SOC 2, ISO 27001, HIPAA or similar certification, and this page isn’t a claim of regulatory compliance. If your firm needs a specific standard before granting access, say so on the first call and you’ll get a direct answer about whether we can meet it.
Reporting a problem
If you find a security issue with this website, or with how we handle your data, email David@rift-mark.com. It will be looked at the same day. Our contact details are also published at /.well-known/security.txt.