Security at RocketParts

Access to RocketParts systems is role-based and least-privilege, segregated into levels (Administrator, User, and No Access), with multi-factor authentication required on privileged and remote access. Access is granted only after a signed agreement, IP/NDA, and Information Security Policy acknowledgement — and never before a person's official start date. User access and roles are reviewed at least quarterly and at any role change. When someone leaves, access to all systems is removed within 3 business days, MFA/SSO is disabled, and any shared secrets they could reach are rotated. Access into a client's systems is provisioned and deprovisioned in coordination with the client's process.

Changes follow a documented secure development lifecycle — our Secure Development Policy, Tech Standards, and Code Review / PR Process. Every change requires peer code review and documented, successful testing before it merges, and development and testing happen in environments logically separated from production. We run automated dependency vulnerability scanning on our repositories and triage findings through the same review and change-management process. Version control preserves full change history and attribution to support rollback. When we build inside a client's environment, we follow the client's SDLC and change-approval process.

We don't operate a product and don't retain client production data on our own infrastructure. Where an engagement requires access to client data, that data stays under the client's ownership and control, is accessed under NDA/DPA, and is used only for the engagement. We classify data into Public, Internal, Client Confidential, and Company tiers, and restrict client-confidential information to the people assigned to that engagement on a need-to-know basis. Data is encrypted in transit and, where the platform supports it, at rest.

We use continuous control monitoring to verify our controls operate as intended, and we maintain a documented incident response plan covering identification, reporting, response, and notification. For incidents that involve a client environment, we coordinate with the client and follow the client's incident response process. Escalation procedures route high-severity issues to leadership promptly, and corrective actions are tracked to closure.

We hire experienced people and verify them through background checks where available by jurisdiction, documenting any exceptions. Before access is granted, everyone signs employment/contractor and IP/NDA agreements and acknowledges our Information Security Policy, and is assigned security-awareness training. A confidential, anonymous whistleblower channel is available for anyone to raise concerns, and retaliation for good-faith reporting is prohibited.

We rely on reputable managed SaaS and cloud providers rather than self-operated infrastructure. We review their security posture and attestation reports (e.g., SOC 2) and perform a vendor risk review on at least an annual basis. Our providers are responsible for the physical and platform security and availability of the services they host, complementing our own controls.