Security at RightPath.
This page is maintained by RightPath to answer common security and privacy questions about Pathway and rightpathdata.com. It describes controls we operate today, not an independent audit or certification.
Access is invite only
Pathway has no public sign-up. A RightPath admin invites a named person to a single client account and assigns their role. Invitation links are single-use and expire; an invalid or expired link returns a not-found page with no account details.
Data is scoped to your account
Every dataset row carries an account identifier, and database-level row policies check the signed-in user's membership on every read. A user who belongs to one account cannot query another account's data even with a crafted request.
Roles are stored separately from profiles
Administrative rights live in a dedicated roles table checked by the database, not in a value the browser can set. Elevating your own permissions from the client is not possible.
Keys stay on the server
AI, email, payment, and service credentials are stored as server-side secrets and read only inside backend handlers. No secret key is present in the JavaScript delivered to your browser, and calls to third-party APIs are proxied through our own endpoints.
Encrypted in transit and at rest
The site is served over HTTPS with HSTS. Our managed database provider encrypts data at rest and requires TLS for all connections.
Hardened browser headers
Responses set a content security policy, frame and MIME-type protections, a strict referrer policy, and a restrictive permissions policy. Signed-in pages and invitation pages are additionally marked no-store and no-index.
Validated input, parameterized queries
Every public endpoint validates its payload against a strict schema with length limits before anything is processed. Database access goes through a parameterized client, and we do not render user-supplied HTML, which closes off SQL injection and stored cross-site scripting.
Abuse and cost controls
The contact form, data ingest API, and AI assistant are rate limited per caller, with an additional durable per-account cap on AI usage so a single account cannot exhaust shared capacity.
Clean logs and error responses
Tokens, keys, and passwords are never written to logs. Backend errors are recorded server-side and returned to callers as generic messages so internal schema and provider details are not exposed.
Admin activity is recorded
Invitations, role changes, AI access grants, and password resets are written to an append-only audit log with the acting administrator, the target user, and a timestamp.
Shared responsibility
RightPath is responsible for the application, its access rules, and how we handle the data you send us. Our cloud, email, AI, and payment providers are responsible for the security of the infrastructure and services they operate. You are responsible for protecting your own sign-in credentials, telling us promptly when someone should lose access, and choosing what data you send into Pathway.
What we do not claim
We do not currently hold SOC 2, ISO 27001, HIPAA, or PCI certification, and nothing on this page should be read as an independent verification or a guarantee against breach. If your procurement process needs formal documentation, contact us and we will tell you exactly what we can provide.
Reporting a vulnerability
Email security@rightpathdata.com with steps to reproduce. We acknowledge reports within two business days and will keep you updated until the issue is resolved. Please do not run automated scans against production or access data that is not yours while testing.
Privacy
What we collect, where it is stored, how long we keep it, and how to request deletion are covered in our privacy policy.