Rutter Trust Center

generated: '2026-11-05'
method: searched
source:
- https://trust.rutter.com/
- https://www.rutter.com/pricing
- https://help.rutter.com/articles/6297782631-how-does-rutter-store-and-manage-data
url: https://trust.rutter.com/
host: trust.rutter.com
platform: vanta
platform_evidence: Page is served by Vanta Trust Center (assets.vanta.com signature manifest; "powered by Vanta" link); 33
  vanta references in the HTML.
company: Rutter
website: https://www.rutter.com/
contact: security@rutterapi.com
certifications:
- SOC 2 Type II
- ISO 27001:2022
- GDPR
frameworks:
- name: SOC 2
  source: https://trust.rutter.com/
- name: ISO 27001:2022
  source: https://trust.rutter.com/
- name: GDPR
  source: https://trust.rutter.com/
resources: Penetration Test I 2024 / 2025 / 2026; Certificate of Liability Insurance I 2024; Rutter - Data Processing Agreement
  (2023 Update).pdf
document_access: Documents are listed publicly; downloading requires "Request access" on the Vanta portal.
control_categories:
- name: Infrastructure security
  controls: 20
- name: Organizational security
  controls: 12
- name: Product security
  controls: 5
- name: Internal security procedures
  controls: 34
- name: Data and privacy
  controls: null
control_visibility: public control names, no evidence
overview: '"Rutter API is designed to be secure by default. Strict access controls are implemented to restrict access to the
  user data (i.e. data synchronized from connected accounts). Encryption at rest and in transit is enforced throughout our
  infrastructure and access logs are retained for detection of unauthorized access and investigation in case of a security
  incident."'
compliance_notes:
  data_retention: 'Help center: deleted user data becomes irrecoverable after 30 days; deleted connections and credentials
    are permanently deleted after 7 days; API request and webhook logs are retained up to 30 days (searchable 14 days).'
  privacy_notice: https://rutterdocs.s3.us-east-2.amazonaws.com/FW_15501597_4_Rutter+Global+Privacy+Notice.pdf
  SOC 2 Type II: '"SOC 2 Type II Report I 2024", "SOC 2 Type II Report I 2025" (Compliance resources)'
  ISO 27001:2022: '"ISO Certificate 27001:2022 I 2024", "ISO Certificate 27001:2022 I 2025" (Compliance resources)'
  GDPR: 'Listed under Compliance; pricing FAQ: "We comply with GDPR requirements for data deletion and data processing."'
probe: true
evidence:
- url: https://trust.rutter.com/
  status: 200
  note: rendered with a headless browser (fetch-url.py) on 2026-11-05; the plain GET returns the Vanta shell only