Data Privacy and Security
Ranmi Inc · Version 1.0 · Effective 21 October 2026
Summary
Your workspace data belongs to you. It is kept separate from every other customer's data, it is never sold, and it is never used to train AI models.
- What we hold: your account details, what your team enters into your workspace, and, only if you connect them, your work mailbox, calendar and contacts.
- Where it lives: in the United States (US East), in a PostgreSQL database run by Neon and private file storage run by Vercel. Both encrypt stored data with AES-256 and hold SOC 2 Type II reports.
- Who can see it: only the people you invite to your workspace, within the role you give them. Ranmi staff do not view your data except as described in section 5.
- AI: content you choose to act on with an AI feature is sent to Anthropic (Claude) to produce the answer. Anthropic does not train on it and deletes it within 30 days.
- Leaving: you can disconnect integrations at any time, export your data, and have your account and workspace deleted.
Our Privacy Policy covers what we collect and your choices in full; this page adds how the data is stored and protected.
1. What we collect and why
We collect only what is needed to run the features you use. Your organisation decides what goes into its workspace and is the data controller for that content; Ranmi processes it on your behalf.
| Data | Examples | Why we hold it |
|---|---|---|
| Account | Name, work email, password (stored only as a one-way hash), optional two-step sign-in secret | To sign you in and secure your account |
| Workspace content | Firms, contacts, notes, tasks, projects, pipeline stages, meetings, team chat, uploaded documents | To run the service for your team |
| Connected mailbox (optional) | Gmail or Outlook conversations, sending as you, read and archive state | To show and send email next to the firms and people it concerns |
| Connected calendar (optional) | Events on your primary Google or Outlook calendar | To schedule meetings and keep them in step |
| Contacts import (optional) | Google contacts you choose to import | Read once; only the contacts you confirm are saved |
| AI requests | The text or records you ask an AI feature to work on | To produce the answer you asked for |
| Billing (paid plans only) | Plan, billing status, Paystack customer and subscription IDs | To manage your subscription. Card numbers are passed to Paystack and never stored or logged by Ranmi |
| Security logs | Sign-in time and method, staff administrative actions, data exports | To detect misuse and keep an audit trail |
Email attachments in a connected mailbox are fetched from your provider when you open them and are not stored by Ranmi. We use one essential sign-in cookie and no advertising or third-party tracking cookies.
2. Where data is stored
All Ranmi data is processed and stored in the United States, in the US East region.
| Component | Provider and location | Protection |
|---|---|---|
| Application | Vercel, Washington, D.C. (US East) | TLS 1.3 in transit; AES-256 at rest; SOC 2 Type 2 and ISO 27001 |
| Database | Neon (PostgreSQL), US East | TLS 1.2+ in transit; AES-256 at rest with managed keys; annual SOC 2 Type II audit |
| Files | Vercel Blob, private store | AES-256 at rest; no public links; served only to signed-in people allowed to see them |
| System email | Resend, US East | Sign-in, invite and notification emails only |
If you are outside the United States, using Ranmi means your data is transferred there. We rely on providers that apply recognised safeguards for such transfers, and we apply the same protections described here wherever data is held.
3. Service providers
Ranmi uses a small set of providers, each bound by its own data processing terms. We share with each only what its job needs, and we do not allow any of them to use your data to train models.
| Provider | What it does for Ranmi | When your data reaches it |
|---|---|---|
| Vercel | Hosts the application and private file storage | Always |
| Neon | Managed PostgreSQL database | Always |
| Anthropic (Claude) | AI features: drafting, summaries, research, the Ranmi AI assistant | Only content you ask an AI feature to work on. Deleted by Anthropic within 30 days |
| Tavily | Web search for AI research features | Only search queries about public organisations |
| Sign-in, Gmail, Google Calendar, Google Contacts | Only if you sign in with Google or connect them | |
| Microsoft | Sign-in, Outlook mail, calendar and contacts | Only if you sign in with Microsoft or connect them |
| Hunter.io | Finding and checking professional email addresses | Only if your workspace connects its own Hunter.io key |
| Paystack | Card payments | Only on paid plans. Card details pass through Ranmi's server over an encrypted connection to Paystack and are never stored or logged |
| Resend | Sign-in, invite and notification emails | Your name and email address on those messages |
We tell customers before adding a new provider that would receive workspace content.
4. How we protect data
Every request is checked on the server against your workspace and your role; access is never just hidden in the screen.
| Area | What is in place |
|---|---|
| Data in transit | All traffic uses HTTPS. Browsers are told to use HTTPS only (HSTS, two years) |
| Data at rest | Database and file storage are encrypted with AES-256 by our providers |
| Stored secrets | Google and Microsoft access tokens, workspace API keys and two-step sign-in secrets are additionally encrypted by Ranmi with AES-256-GCM before they are saved |
| Passwords | Stored only as bcrypt hashes (cost 12). Repeated failed sign-ins are slowed and then blocked for a few minutes |
| Two-step sign-in | Optional authenticator-app codes (TOTP, for example Google Authenticator or 1Password). No SMS codes. We recommend it for every user |
| Sessions | One httpOnly, secure cookie that page scripts cannot read. It lasts 30 days with "Remember me", otherwise 1 day |
| Workspace separation | Each customer's data is tied to its workspace and checked on every request; key tables also use database row-level security |
| Roles | Owner, admin, editor, viewer and project guest roles limit what each person can see and change. Guests see only the projects they are invited to |
| Files | Stored privately and served only to signed-in people allowed to see them; there are no public file links |
| Web protections | Content Security Policy, X-Frame-Options DENY against clickjacking, and validation of all input on the server |
| Audit trail | Sign-ins, staff administrative actions, staff sign-ins to customer accounts, and data exports are logged |
| Connected mail | Ranmi requests from Google and Microsoft only the access each feature needs; disconnecting revokes it at the provider |
5. Access by Ranmi staff
No one at Ranmi views your workspace or mail unless you ask us to for support, it is needed to investigate a security or abuse problem, or the law requires it.
- The staff admin area is separate from the product, with its own sign-in.
- If support needs to see what you see, staff can sign in as a user. Each such session records who did it, for which account, why, and when it started and ended.
- Administrative actions taken on your account, such as a password reset or suspension, are logged.
- Access to production systems and secrets is limited to the people who operate the service.
6. Keeping, exporting and deleting data
We keep your data while your workspace is active, and delete it when you ask, after a 30-day window to undo mistakes.
- Disconnecting mail or calendar (Profile, Email accounts) revokes Ranmi's access at Google or Microsoft and deletes the conversations Ranmi imported from that mailbox.
- Deleted workspaces can be restored for 30 days and are then permanently removed by a scheduled purge. You can ask us to purge sooner.
- Backups: the database keeps a rolling restore history for recovery. Deleted data leaves that history within 30 days.
- Deleting your account is available under Profile, Sign-in and security, or on request.
- Exporting: firms and contacts can be exported to a spreadsheet from the Database; for a full copy of your workspace, email us and we will provide one.
- Contacts import keeps no access to your Google contacts after the one-time read.
7. Security incidents
If we have reasonable grounds to believe your data has been accessed or acquired without authorisation, we will notify your workspace owner without undue delay and within 72 hours of becoming aware of it, and we will notify the Data Protection Commission and other regulators where the law requires.
The notice will say what happened, what data was affected, what we have done to contain it, and what you may need to do, such as resetting passwords or reconnecting a mailbox. We will follow up as we learn more.
To report a security concern, email privacy@ranmi.app.
8. Your rights
You can ask to see, correct, export or delete the personal data we hold about you, or object to how it is used. We respond within 21 days.
People whose details a customer keeps in Ranmi, for example contacts at firms they work with, should send requests to that customer, which controls that data. If they write to us instead, we pass the request on and help the customer act on it.
Ranmi Inc is completing its registration as a data controller with Ghana's Data Protection Commission under the Data Protection Act, 2012 (Act 843), and follows the Act's principles in the meantime.
9. Pilots
Pilots run on the same live platform, under the same protections, as paying customers.
- Start small if you prefer. You can begin with sample or non-sensitive records and connect a real mailbox only when you are comfortable.
- Turn on two-step sign-in for every pilot user, under Profile, Sign-in and security.
- Features may change. Ranmi is actively developed. Changes never reduce the protections on this page without telling you first.
- Confidentiality. We treat everything you share during a pilot, including workspace content and feedback, as confidential. We will not quote you or name your organisation publicly without your written permission.
- At the end of the pilot you choose: keep your workspace and continue, export it, or have it deleted. If you choose deletion, we delete it within 30 days and confirm in writing.
10. Contact
- Privacy and security: privacy@ranmi.app
- Product support: support@ranmi.app
We review this page at least once a year and whenever the platform changes in a way that affects it. Customers are told of material changes in advance.