Trust & Security

Overview

Reckap Solutions LLC is a US IT company based in Albuquerque, NM. This Trust page covers practices for reckap.com, free browser tools, CareDue, and how we approach access during custom delivery. Pair it with our Privacy Policy and Terms of Use.

We write what we do today. When we add public attestations, we will update this page.

Compliance status

Reckap does not currently publish SOC 2, ISO 27001, or similar third-party security attestations. We do not claim HIPAA certification as a product.

For prospect security questionnaires on custom work, email security@reckap.com. We respond to reasonable requests under NDA when appropriate.

Security practices

• Transport security - Public sites and APIs are served over HTTPS/TLS.
• Secrets - API keys and service-role credentials stay on the server; they are not shipped in public client bundles.
• Access - Staff access to client systems is limited to named operators and the systems required for the scoped job.
• Application controls - Dashboard and CMS features that use Supabase rely on authentication and row-level security (RLS) patterns for user data.
• Uploads - Media uploads that use Cloudinary go through signed server flows with type and size checks where implemented.
• Dependencies - We prefer pinned, known package versions and keep hosting platforms updated through our providers.

Application and data handling

Marketing site and browser tools. Many file tools process data in the browser so files are not uploaded to Reckap for the job. Page analytics and hosting still generate ordinary web logs.

CareDue. Maintenance logs are designed to stay on device for offline use. Distribution and ads follow Google Play policies.

Custom delivery. Customer content ownership, retention, and environment access are defined in the SOW. We do not use client delivery data to train public foundation models.

Infrastructure

The marketing site is hosted on Vercel. Product and dashboard workloads that use Supabase run on Supabase-managed Postgres, Auth, and Storage in the regions configured for that project.

We do not invent data-residency guarantees beyond what those providers document for the chosen region.

Subprocessors

Vendors that may process personal information or host systems for Reckap:

We update this table when vendors change. Details also appear in the Privacy Policy.

Access during client delivery

We ask only for systems needed to deliver the scoped job. Credentials stay with named operators. Access and retention rules for medical billing, pharmacy MES, or similar work are written into the engagement.

Ethical scraping and public-data extraction, when in scope, stay on allowlisted sources with robots.txt and terms review, rate limits, field lists, and retention limits. We do not collect from authenticated areas we are not licensed to access, and we do not bypass access controls.

Incidents and vulnerabilities

To report a suspected security issue or vulnerability affecting Reckap systems, email security@reckap.com with enough detail to reproduce the issue. Please do not include unnecessary personal data in the report.

We investigate reports in good faith and aim to notify affected customers without undue delay when a breach of personal information triggers legal notice duties.

We do not currently operate a public bug bounty program.

Privacy requests

To access, update, or delete personal information we hold about you, email privacy@reckap.com. See the Privacy Policy for categories of data and rights.

Contact

Trust and security: security@reckap.com.

Reckap Solutions LLC, 1209 Mountain Rd Pl NE #6830, Albuquerque, NM 87110, USA.

Last reviewed date matches the “Last updated” stamp at the top of this page.