> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rippit.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Data integration security

> Authorization, access scope, credential handling, and compliance posture for the connections that ingest your conversation data.

This page covers the connections that pull conversation data into Rippit on a schedule, currently Intercom and Zendesk. For the MCP server and Rippit's own MCP client, see [MCP security](/security).

## How authentication works

Rippit connects to your helpdesk through the OAuth 2.0 authorization code grant. You authenticate against your helpdesk, never against Rippit, and **Rippit never receives a password or an API key**.

```mermaid theme={null}
sequenceDiagram
    participant Admin as Workspace admin
    participant Rippit as app.rippit.com
    participant Browser
    participant Helpdesk as Your helpdesk

    Admin->>Rippit: Choose integration, give subdomain or region
    Rippit->>Rippit: Mint single-use state nonce
    Rippit-->>Browser: Redirect to helpdesk authorize URL
    Browser->>Helpdesk: Admin signs in and approves access
    Helpdesk-->>Browser: Redirect with authorization code
    Browser-->>Rippit: Authorization code and state
    Rippit->>Rippit: Validate and consume state nonce
    Rippit->>Helpdesk: Exchange code for access token (server side)
    Helpdesk-->>Rippit: Access token
    Rippit->>Helpdesk: Verify token, resolve account identity
    Rippit->>Rippit: Store connection, begin scheduled sync
```

The authorization request carries a single-use state nonce that expires if it is not redeemed, so a replayed callback matches nothing. After the exchange, Rippit verifies the token against the source system before storing the connection, and rejects a source account already connected to your workspace.

Where the source system supports a scope parameter, Rippit requests read access in this step. Zendesk receives `scope=read`. Intercom has no scope parameter, so permissions come from the Intercom app configuration shown on its authorization screen.

### The token Rippit holds

Rippit stores a long-lived access token for the account that authorized the connection, and uses it for every scheduled sync. It acts as that account, which is why the account you choose determines what Rippit can reach.

Revoking the grant in your helpdesk invalidates the token immediately.

## Access scope

Rippit issues no writes. There is no code path that creates, updates, or deletes anything in your helpdesk. Every Zendesk call is a `GET`, and Rippit creates no Intercom conversations, replies, notes, or tags.

Rippit can read only what the authorizing account can read. Use a dedicated service account where the source system supports one, so you control what Rippit can see.

## What reaches Rippit

Full conversation content, not just metadata: message bodies, participants, and attached fields including custom fields. Zendesk attachments are downloaded and stored rather than linked.

**Rippit does not train any AI models. Your data is used for inference only.**

## Revoking access

Revoking Rippit's authorization in the source system stops the token working immediately. **Disconnect** in Rippit removes the stored connection and stops future syncing. Neither deletes conversations already imported. See [how data integrations work](/plg/data-integrations) for what account deletion does and does not remove.

## Hosting and compliance

|                     |                                          |
| ------------------- | ---------------------------------------- |
| Hosting             | AWS, multi-AZ, staging and production    |
| Encryption          | At rest, in transit, and during backup   |
| SOC 2 Type II       | Security, Confidentiality, Privacy       |
| ISO 27001           | Certified                                |
| ISO 42001           | Certified (AI management systems)        |
| PCI DSS 4.0         | Level 1 Service Provider AOC             |
| HIPAA               | Type 1 Attestation (AT-C 105, 205, 315)  |
| GDPR and CCPA       | Compliant                                |
| Penetration testing | Periodic, plus vulnerability assessments |
| Bug bounty          | Private program via HackerOne            |
| Access control      | Limited to authorized personnel          |

Subprocessors: AWS (US and EU), MongoDB, Coralogix, Fullstory (no end user data), Google Cloud Platform (Gemini, US only, where used).

Signing up for Rippit accepts the [Terms of Service](https://www.rippit.com/terms-of-service) and [Privacy Policy](https://www.rippit.com/privacy-policy). No separately negotiated contract is required, and the Privacy Policy is what governs personal data by default.

A standard Data Processing Addendum is available on request, alongside current certificates, audit reports, and the full subprocessor list, from the [Rippit Trust Center](https://trust.rippit.com/).