Your financials and IP, handled like they matter
An R&D study touches the material a company guards hardest: payroll, ledgers, product roadmaps, engineering activity, and trade secrets. So the interesting question isn’t whether we say we take security seriously - it’s which controls are actually running while your study is built.
Below is what we do, stated plainly, plus what we don’t claim.
Concrete controls - not slogans
The protections below describe how your data is actually handled while a study is in flight - and, in the same table, the two certifications we do not hold.
| Control | What it means for your data | Status |
|---|---|---|
| Encrypted in transit and at rest | Data moves over TLS and is encrypted at rest in storage. That applies to uploads, connector pulls, and every deliverable we issue. | Running today |
| Least-privilege access | Access is granted per engagement, on a need-to-know basis, behind strong authentication - not handed out platform-wide by default. | Running today |
| Data minimization | We ask for what the study actually requires and nothing speculative. Fewer fields collected is fewer fields exposed. | Running today |
| Your data isn’t training data | Your confidential information is never used to train public or third-party AI models. It is used to perform your study, and for nothing else. | Running today |
| Audit logging | Sensitive actions are logged, so access and activity across the platform leave a reviewable record rather than a memory. | Running today |
| Controlled document handling | Payroll files, ledgers, and technical documents are stored, transmitted, and processed inside access-restricted workflows. | Running today |
| Retention and deletion | We follow a defined retention and deletion policy and can remove your data on a documented schedule when the engagement ends. | Running today |
| Segregated environments | Each client’s data is logically segregated, and access to production is restricted and monitored. | Running today |
| SOC 2 report | We hold no SOC 2 report today, and we will not claim an attestation we do not have. | Not held |
| ISO certification | We hold no ISO certification today. | Not held |
| Formal SOC 2 examination | On our roadmap. We describe it as a commitment rather than an accomplishment. | Roadmap |
AI makes us faster. It doesn’t get your data for free.
AI accelerates intake, document parsing, computation, and first-draft narratives. It runs under governance: taxpayer-identifying data is redacted before processing, calls go through enterprise Azure AI Foundry endpoints in production, usage is metered and logged, and nothing you give us is used to train public or third-party models.
Qualification decisions, QRE amounts, and the final numbers are made by people - then reviewed and finalized by our R&D experts before the study is issued. The AI never gets the last word, which is both a quality control and a security one.
Where we are - stated honestly
Because an R&D study is built from tax-return information, we design our safeguards around the expectations that apply to tax professionals handling that data - the safeguarding guidance in IRS Publication 4557, the information-security program requirements of the FTC Safeguards Rule, and the confidentiality rules of IRC §7216, which we implement as an automated redaction step rather than a policy reminder.
We maintain written information-security practices covering access, retention, and incident response, and we will walk a prospective client’s security team through them on request.
On certifications: we hold no SOC 2 report and no ISO certification today. A formal SOC 2 examination is on our roadmap, and we describe it as a commitment rather than an accomplishment - we won’t claim an attestation we don’t have. We also won’t tell you a system is “100% secure” or “unhackable”; nobody can. What we offer is specific controls, described accurately, and the willingness to be questioned about them.
Have a security questionnaire, a vendor review, or contractual requirements? Email [email protected] - we typically reply within one business day.
The five questions security teams ask us
Where is our data hosted, and who else touches it?
Who at Ricerca can see our financials and source data?
Is our data used to train AI models?
Can we have our data deleted when the engagement ends?
Will you complete our security questionnaire or review an NDA?
More detail lives in the Privacy Policy and the Terms of Service. If you want to see the safeguards in the context of the work they protect, read how a study works or what Audit Protection covers.