# Security and data boundaries

Evaluate Ridian using concrete access and data-flow boundaries.

Source: https://docs.getridian.com/trust/security/
Language: en
Reviewed: 2026-09-20

## Provider access and delegated clients

Ridian connects to providers using the applicable OAuth or credential-based method. A client receives a Ridian authorization for permitted operations; documentation examples never require handing provider credentials to an assistant. Effective permissions are checked at the service boundary.

## Understand each data path

Sync processing, live API queries, account metadata and operational records have different purposes and retention behavior. Do not translate “live access” into a blanket claim that no data is ever stored. Event content returned to an authorized third-party assistant also enters that client's own data-handling context.

For an integration, distinguish the management of the integration from the end-user data the authorized application is allowed to process. A management role is not automatically a data-access grant.

## Procurement checklist

- Define the use case, providers, workspaces and client applications.
- Agree required content levels and who can authorize access.
- Review the applicable [privacy information](https://getridian.com/privacy/), [compliance information](https://getridian.com/compliance/) and contract/DPA with your contact.
- Confirm any required processing-location, retention, support or availability terms explicitly. Do not infer a certification or SLA from infrastructure branding.
- Test revocation and an excluded calendar before inviting external users.

## Reporting a concern

Use `security@getridian.com` for a security concern. Include a reproducible description without credentials or unrelated personal data. For ordinary setup questions, use [support](https://docs.getridian.com/support/).