Security at RustLabs

RustLabs (Rustlabs LLC, New York) runs an expert network that produces training and evaluation data for AI labs. The data we handle falls into three classes, each with its own baseline: client data (task content, work product, specifications, credentials), expert personal data (applications, resumes, signatures, payout status), and company data. This page describes the controls we apply today. Where a client contract imposes a stricter requirement, the contract controls for that engagement.

Security questions, vulnerability reports, and requests for our full internal Information Security Policy: hello@rustlabs.ai.

The expert platform is a single Next.js application hosted on Vercel (US-East), backed by Neon Postgres with automated backups and point-in-time restore. Files are stored in Vercel Blob. Authentication is handled by Clerk; transactional email by Resend; expert payouts, tax-form collection and KYC by Dots. Government-ID images, tax identifiers and bank details are never stored on RustLabs systems; they stay with the payment and verification providers.

All connections use TLS. Database and file storage are encrypted at rest with provider-managed keys. Secrets live only in Vercel environment configuration and encrypted CI secrets, never in the repository.

• Access is granted on a need-to-know, least-privilege basis and reviewed when people join or leave.
• The platform's administrative controls are not served on production at all. The admin plane runs only on a private-network host and is gated by a per-person GitHub OAuth allowlist, so a compromised expert account cannot alter the platform.
• Access rights are database state, not code, so a deploy cannot silently widen access. Feature flags default off.
• Experts receive access only to the specific project workspaces they are assigned. Access is removed at project end or on violation.
• Every person uses an individually identifiable account. Account sharing is prohibited for staff and experts alike.

• All code changes flow through Git (GitHub, private organization) with CI gates on every pull request: type-check, build, a public-bundle secret scan, and a dependency vulnerability audit (high/critical fail the build), plus an advisory automated security review covering access control, auth bypass and secrets exposure.
• The production branch is protected: every change requires a pull request and a human approval, enforced against administrators, so automation and AI agents cannot merge to production on their own. Deploys run only from that protected branch.
• Staging is fully isolated from production (separate database, private network only).
• A production canary, scheduled every 15 minutes and run again after every production deploy, verifies that the deployed access gates are intact.

Every expert who works through RustLabs signs an Expert Contributor Agreement, a Confidentiality Agreement and the Expert Code of Conduct on the platform before receiving project access. The Code covers identity (the verified person does the work; no account sharing), data handling (project materials stay on the project platform; no external AI tools; no VPN or location masking), and reporting.

Signatures are recorded with the document version, a SHA-256 fingerprint of the exact text signed, a typed legal name, timestamp, a hashed IP address, and user agent, and a countersigned PDF is issued to the expert. A version bump forces re-acceptance across the network.

Work product is assigned to RustLabs or, where the project instructions provide, directly to the client under the Contributor Agreement, with a five-year confidentiality term and clients named as third-party beneficiaries.

• Client data is used solely to perform the engagement, is never placed in public repositories, personal accounts or unapproved AI tools, and is returned or securely deleted at the client's choice at engagement end, with written certification on request within 30 days.
• Client and expert data is not entered into third-party AI tools except under RustLabs-controlled accounts whose terms exclude training on inputs, and only where the governing contract permits it.
• Records supporting billing and workforce compliance (signed agreements, acknowledgments, screening results, payout records) are retained for as long as a client contract or law requires, typically seven years after an engagement ends. Other personal data is kept only as long as reasonably needed for the purposes in our Privacy Notice.
• Data-subject requests go to privacy@rustlabs.ai and are answered within 30 days. See the Privacy Notice and Expert & Applicant Privacy Notice.

Suspected incidents (unauthorized access, credential compromise, data exposure, lost device, expert security violation) are reported immediately to the security owner, who acts as incident commander. We preserve evidence, contain (rotate exposed credentials, disable affected accounts, expire sessions), assess scope, and notify affected clients within the notice window in their agreement, measured from discovery rather than confirmation, with supplemental notices as facts firm up. Affected experts or applicants are notified where their personal data was involved. Every incident gets a dated post-incident record retained for seven years.

Vendors that may process client or expert data: Vercel (hosting, files), Neon (database), Clerk (authentication), Resend (email), Dots (payouts, tax forms, KYC), GitHub (source control), Anthropic (model API, RustLabs account, no training on inputs). Vendors that process expert personal data for screening or verification must be commercially recognized and bound by written confidentiality and data-protection obligations no less protective than our client commitments.

We publish what we have, not what we intend to have. Controls currently in progress, listed so you can hold us to them:

• Third-party identity verification with government ID, liveness and sanctions/PEP screening for every expert before project access.
• Multi-factor authentication for expert platform logins, required on projects whose terms call for it.
• A maintained vendor and subprocessor register with executed data-processing agreements on file.
• Business insurance (general liability, professional/E&O, cyber).
• Annual documented access review and security-awareness acknowledgment.

Questions about any item here, or a security questionnaire to complete: hello@rustlabs.ai.