Trust Center

Everything a reviewer needs, in one place.

Security posture, privacy commitments, sub-processors, data handling, and DPA availability. Maintained and dated — not a footer afterthought.

Last updated · July 5, 2026 Policy version · 1.0 Operating entity · Raft Education LLC (d/b/a Community Works Collective)

Security overview

Updated Jul 4, 2026

RecWorks is a focused platform operated by a small, accountable team. Our controls are documented below in plain language. Where we are working toward formal attestation, we say so on the roadmap rather than implying a certification we don't yet hold.

Encryption
TLS 1.2+ in transit; AES-256 at rest for all stored data and backups.
Access controls
Least-privilege access, scoped per-role. Production access is limited and logged.
MFA
Multi-factor authentication is enforced on all administrative and infrastructure accounts.
⚠ TODO · confirm operational before publish
Backups
Automated daily encrypted backups of the primary database, with 7-day retention, in the same US region as production.
Monitoring
Infrastructure and application monitoring with alerting on anomalous activity.
⚠ TODO · confirm operational before publish
Incident response
Documented triage and containment process; affected customers and, where required, supervisory authorities notified within 72 hours.
⚠ TODO · confirm operational before publish

Privacy policy

v1.0 · Jul 3, 2026

This policy is specific to RecWorks Credentials, operated by Raft Education LLC (d/b/a Community Works Collective). It describes what we collect, why, where it lives, and the rights you have over it.

We do not use third-party analytics or advertising trackers. This site sets strictly-necessary cookies only. The claims made here are reflected in how the site itself behaves.

Full policy text is available as a versioned document on request and will be published in full at launch. See Data processing for specifics, and Contact to reach our privacy team.

Sub-processors

Updated Jul 5, 2026

The third parties that process data on our behalf, with their role, the data shared, hosting region, and their own compliance attestations. Values shown are indicative pending final confirmation.

Sub-processor Role Data shared Region Attestations
Vercel Application hosting & CDN Name, email (hosting & delivery); badge images (Blob storage) US East (iad1) SOC 2 Type 2, ISO 27001
Supabase Database Name, email, credential records US West (Oregon, us-west-2) SOC 2 Type 2
Auth0 (Okta) Administrator authentication Admin name, email, credentials. No learner passwords are stored. US SOC 2 Type 2, ISO 27001
Twilio SendGrid Transactional email delivery Name, email US SOC 2 Type 2, ISO 27001
Embed host platforms (Circle, Notion, Thinkific) are operated and contracted by you, not by RecWorks. Our embedded forms run inside them, but no learner data is transmitted to those platforms by RecWorks.

Material changes to this list are published here before they take effect.

Data processing

Updated Jul 4, 2026
We collect name and email only.
Data minimization isn't a policy line for us — it's the design. We don't collect what we don't need to issue and deliver a credential.
What we collect
Learner name and email address; the credential records and evidence you configure. Nothing more.
Where it lives
United States regions (database in US West/Oregon; hosting in US East), on the sub-processors listed above.
Retention
Credential records are retained for the life of the credential so verification remains possible. Account data is deleted on request or account closure.
Data subject rights
Access, correction, export, and deletion requests are handled via privacy@recworks.co, typically within 30 days.

DPA availability

Updated Jul 3, 2026

A Data Processing Agreement is available on request. Email privacy@recworks.co and we'll send our standard DPA for review.

Request a DPA

Compliance roadmap

Updated Jul 3, 2026

We state our commitments plainly and don't display badges we haven't earned.

SOC 2 Type 1
Targeted Q1 2027. In progress — this is a commitment, not a certification.
Targeted Q1 2027

Contact

Privacy and security questions go to a monitored RecWorks address:

privacy@recworks.co