Security and privacy
Your apps aren’t live yet: they stay in the hands of the people you choose. Here’s how Riqoch looks after them, and after your data.
How Riqoch protects your work
Your apps aren’t live yet: they stay in the hands of the people you choose.
Behind Cloudflare
The site, the app and the reviews go through Cloudflare’s network, which filters attacks and encrypts every connection.
Stored in the European Union
Published versions are kept in storage under EU jurisdiction; accounts and comments are in a Supabase database.
Access enforced in the database
Every read and every write goes through access rules in the database: an account only sees what it was given.
Reviews kept apart
Published apps are served from a domain of their own, away from your account, with a password, a visibility setting and an expiry date of one year at most.
Signed desktop app
The Mac app is signed and notarised by Apple, and its permissions are kept to what it needs.
Audited before launch
A full security audit, a content security policy and security headers on the app and the reviews.
Your code
With a local folder
Your app runs on your computer: only the build you publish goes online.
In Cloud mode
Riqoch fetches the GitHub repository you picked and runs it in a dedicated online environment.
Your connections
GitHub and Slack tokens never leave our servers, and you can disconnect them at any time.
The feedback assistant
Only if you use it, a comment and its context are sent to Anthropic to produce an answer, never to train its models.
Your Google data
Signing in with Google only shares your name, email and photo, to create your account.
- No access to Gmail, Google Drive, your contacts or your calendar
- Never sold, never used for advertising
- Never used to train artificial intelligence models
- Deleted with your account, at any time
Security, your questions.
Where is my data hosted?
Accounts and comments are in a Supabase database, with access rules for every read and every write. The site, the app and the reviews are served by Cloudflare, and published versions are stored under EU jurisdiction. Everything travels over HTTPS.
Who can see a review?
Those who have the link, within the limits you set: visibility, a password and an expiry date, one year at most.
What happens when a review expires or is deleted?
An expired review can no longer be opened through its link; its comments are kept, and republishing brings it back online. A deleted review is taken off the web.
What about GDPR?
You can delete your account from the app, every email has its unsubscribe link, email addresses never appear on a public review, and our usage analytics never contain the content of your files. The privacy policy lists our providers and your rights.
Do you offer a DPA or a security questionnaire?
Yes. Write to us at contact@riqoch.com: we’ll send you the DPA and answer your questionnaire.
Start the first ricochet.
Install the app, publish your project, send the link. The rest bounces on its own.
Get Started