Built for businesses that get asked for a DPA.
RapidLocal is operated by Salvo Digital LLC, a Wyoming company. Here is exactly who touches your data, how we protect it, and where we are on the compliance roadmap. No vague claims — sources and contacts on this page.
What we do every day.
TLS 1.2+ in transit and AES-256 at rest for every customer data store, including backups.
Role-based access with least-privilege defaults and MFA required on every production system.
Daily encrypted backups with 30-day retention. Point-in-time recovery on the application database.
Documented IR plan. Customer breach notification within 72 hours of confirmation.
Who we share data with — and why.
We notify customers at least 30 days before adding or replacing a sub-processor. Subscribe to updates via security@gorapidlocal.com.
| Vendor | Purpose | Data processed | Region |
|---|---|---|---|
Lovable Cloud (Supabase) Privacy | Application database, authentication, file storage, background queues. | All customer-submitted data: contacts, leads, calls, messages, invoices, files. | United States (us-east) |
Cloudflare Privacy | CDN, edge runtime, DDoS protection, DNS. | HTTP request metadata, IP addresses, transient cache contents. | Global edge; primary US |
Twilio Privacy | Voice calls, SMS messaging, A2P 10DLC brand and campaign registration. | Phone numbers, call recordings, message bodies, sender/recipient metadata. | United States |
OpenAI Privacy | Realtime AI voice agent (gpt-realtime) that answers phone calls, plus post-call transcript analysis. | Voice audio, transcripts, caller phone numbers, business context passed as SIP headers. | United States |
Stripe Privacy | Payment processing for subscriptions, invoices, and deposits. | Billing details, card data (tokenized by Stripe), invoice metadata. | United States (PCI DSS Level 1) |
Resend Privacy | Transactional and marketing email delivery on customer domains. | Email addresses, message contents, delivery and engagement events. | United States |
Google (Workspace + Search Console API) Privacy | Internal company email, document storage, and read-only Search Console data for reporting. | Customer business contact info (Workspace); domain search performance metadata (GSC). | United States |
Where we are. Where we're going.
Report a vulnerability, ask a procurement question.
Email security@gorapidlocal.com with anything related to security, privacy, or compliance. Responsible disclosure is welcomed — we acknowledge within two business days and never threaten researchers acting in good faith.