RapidRatings maintains an information security program designed to protect the financial data you submit on the FHR Exchange. This article covers the certifications we hold, how your data is encrypted and hosted, our vendor and account access controls, and the ways we use aggregated data to improve our models. It is written for your IT, security, and compliance reviewers as much as for you.
Certifications and standards
RapidRatings is ISO 27001:2022 certified. Our information security policies are supported by standards and controls aligned to internationally recognized frameworks including NIST 800-53 rev 4, NIST 800-171, and ISO 27000.
Our data centers also hold ISO 27001:2022 and SOC 1 and SOC 2 certifications.
How your data is encrypted
In transit: HTTPS using TLS 1.2
At rest: AES-256
Both standards are applied across all FHR Exchange services.
Where your data is hosted
RapidRatings services are hosted on Amazon AWS cloud infrastructure.
Production: US East region, deployed across multiple redundant data centers
Disaster recovery: US West region, synchronized with production daily
Vendor access: AWS personnel have no access to the data stored on their infrastructure
Our application architecture
The FHR Exchange is delivered as a multi-tenant SaaS application built on a standard three-tier architecture. Each tier is deployed across multiple load-balanced hosts to ensure continuous availability of the service.
How we manage third-party vendors
All third-party vendors RapidRatings engages with are held to industry-standard information security policies and procedures. We maintain two policies that govern vendor engagement:
Vendor Risk Management Policy
Key Vendor Compliance Review Policy
Together these set the parameters for evaluating, onboarding, and monitoring every third-party vendor whose services touch our environment.
How your data is used beyond your FHR
Your identifiable financial data is only used to generate your Financial Health Rating. It is never shared outside RapidRatings without your authorization. This commitment is set out in our Non-Disclosure Agreement.
Separately, RapidRatings uses aggregated and anonymized data from across the FHR Exchange to:
Inform the continued development and refinement of our ratings models
Produce insights about broad financial health trends across industries and regions
Aggregated and anonymized data cannot be traced back to any individual company. Your identifiable financial statements are never part of this work.
Account access controls
User accounts are managed via defined processes with secure, complex password requirements. We continuously review account controls as part of our broader security program.
Our commitment to continuous improvement
RapidRatings stores data on behalf of many Fortune 500 companies, and our executive team is directly accountable for the information security program that supports that trust. We maintain a culture of continuous improvement: our processes, standards, and controls are reviewed and updated regularly to keep pace with evolving threats and best practices.