How we work inside your systems.

Working in your data

Least access, in writing

We ask for the narrowest access that lets the work happen, usually an export or a scoped view of open proposals. What we can reach is agreed in writing before work starts.

No blanket mailbox access

We don’t ask for access to anyone’s whole inbox.

A person reviews everything client-facing

Every draft is read by a person before it reaches your team, and your team decides whether it goes out at all.

Your CRM stays the record

We work from your records and hand the work back into them. We don’t keep a shadow copy of your pipeline as the source of truth.

Access ends with the engagement

When the work stops, access is revoked and working copies are removed.

This website

HTTPS everywhere

Served over TLS, with HTTP Strict Transport Security.

A strict Content Security Policy

Scripts load only from this site, with no inline scripts. Other sites can’t frame these pages, and the only thing this site frames is the scheduler on Cal.com.

No advertising or tracking

No ad pixels, no cross-site trackers, and no analytics.

Forms without a custom backend

Forms are processed by our host, with spam filtering. There are no credentials in front-end code.

Self-hosted

Fonts, the film and the guide are served from this site, not from third-party CDNs.

What we don’t claim

Riftmark holds no SOC 2, ISO 27001, HIPAA or similar certification, and this page isn’t a claim of regulatory compliance. If your firm needs a specific standard before granting access, say so on the first call and you’ll get a direct answer about whether we can meet it.

Reporting a problem

If you find a security issue with this website, or with how we handle your data, email David@rift-mark.com. It will be looked at the same day. Our contact details are also published at /.well-known/security.txt.