Security and data boundaries

Provider access and delegated clients

Ridian connects to providers using the applicable OAuth or credential-based method. A client receives a Ridian authorization for permitted operations; documentation examples never require handing provider credentials to an assistant. Effective permissions are checked at the service boundary.

Understand each data path

Sync processing, live API queries, account metadata and operational records have different purposes and retention behavior. Do not translate “live access” into a blanket claim that no data is ever stored. Event content returned to an authorized third-party assistant also enters that client’s own data-handling context.

For an integration, distinguish the management of the integration from the end-user data the authorized application is allowed to process. A management role is not automatically a data-access grant.

Procurement checklist

• Define the use case, providers, workspaces and client applications.
• Agree required content levels and who can authorize access.
• Review the applicable privacy information, compliance information and contract/DPA with your contact.
• Confirm any required processing-location, retention, support or availability terms explicitly. Do not infer a certification or SLA from infrastructure branding.
• Test revocation and an excluded calendar before inviting external users.

Reporting a concern

Use security@getridian.com for a security concern. Include a reproducible description without credentials or unrelated personal data. For ordinary setup questions, use support.