Security is core to how Rook Agentics Limited, trading as Rook Agentics ("Rook", "we", "us"), runs its service. Because we review commercial merchant statements, we treat the data you share with appropriate care. This page explains the measures we take.
No cardholder data
We want to be clear about what we do not handle: Rook does not collect, process or store cardholder data (CHD), such as full card numbers, expiry dates or security codes. We review merchant statements, which summarise a business's processing costs. They are not a source of consumer card details, and we are not in the card-payment flow.
Encryption
- In transit: all data, including statement uploads, is transmitted over encrypted (TLS) connections.
- At rest: uploaded statements and stored data are encrypted at rest in a secure, private storage location that is not publicly accessible.
Access controls
- Access to uploaded statements and customer data is restricted to authorised Rook staff who need it to do their job.
- Access is logged, and we apply the principle of least privilege.
- Credentials and keys are managed securely and reviewed periodically.
Infrastructure
- We use reputable, secure cloud hosting and storage providers with strong security track records.
- Production systems are separated from general access, and administrative access is limited and monitored.
- We rely on vetted third-party processors (for example, for email and analytics) that operate under data-processing agreements. See our Privacy Policy for detail.
Data retention and deletion
We keep data only as long as we need it. Uploaded statements are retained for a limited period and then deleted unless you become a client. Full details are in our Privacy Policy.
Ongoing reviews
Security is not a one-off. We review our practices, access and providers on a regular basis and improve them as our service grows and as best practice evolves.
Reporting a security concern
If you believe you have found a security vulnerability, or you have any concern about the security of your data, please tell us promptly and we will investigate.
- Security contact: bobby@rookagentics.com
Please give us enough detail to reproduce or understand the issue, and allow us a reasonable opportunity to respond before disclosing it publicly. We appreciate responsible disclosure.
A note on shared responsibility
We work hard to protect your data, but security is a shared effort. Please keep your own devices and email account secure, and only share statements through the channels we provide.