Skip to main content

Trust, Security, and Compliance

Support
Updated

Topics included in this article:

Trust and Security at Rhombus

At Rhombus, protecting customer data and maintaining trust are at the core of everything we do. Security is not something added at the end of development -- it is built into every product, process, and control we operate. Rhombus applies a security-first philosophy that ensures confidentiality, integrity, and availability across our entire platform.

Article Summary

This Security and Compliance Knowledge Base is designed to provide transparency. It explains how Rhombus:
  • Designs products securely using zero-trust principles.
  • Applies encryption and data protection at every stage of the lifecycle.
  • Operates and maintains secure, resilient infrastructure.
  • Undergoes third-party audits and validations.
  • Enforces company-level security practices across employees and processes.
  • Answers frequently asked customer questions about trust and compliance.
We also provide compliance documentation such as SOC 2 reports, penetration test summaries, and data processing agreements under NDA.

Responsible Disclosure

Rhombus welcomes collaboration with the security community. If you believe you have identified a vulnerability, please contact us at responsibledisclosure@rhombus.com or submit a ticket through Rhombus Support. All legitimate reports will be investigated, and we will work with researchers to remediate verified issues.

 

Secure Design Principles

Security at Rhombus begins with design. Our systems are engineered from the ground up with safeguards that protect customer data and ensure resiliency in high-stakes environments. These principles provide the foundation for our compliance with frameworks like SOC 2, HIPAA, GDPR, and CCPA, and they guide every aspect of how our platform is built and maintained.

Zero-Trust Architecture

Rhombus applies a zero-trust model across its ecosystem. No device, user, or request is implicitly trusted. Instead, every interaction must be authenticated, authorized, and encrypted before access is granted. This design:
  • Minimizes the risk of unauthorized lateral movement.
  • Enforces strict verification of all requests.
  • Ensures only trusted devices and users interact with the platform.

Security-First Development

Our platform is built with security as a primary requirement, not an afterthought. Every design decision prioritizes:
  • Confidentiality of customer data.
  • Integrity of video, metadata, and system records.
  • Availability of systems in mission-critical environments such as healthcare, education, and public safety.
By integrating these principles at every stage of development, Rhombus ensures security is inseparable from functionality.

Customer-Controlled Access

Customers maintain full control of their environments. Rhombus employees cannot access customer video or metadata unless explicit authorization is granted. When access is approved, it is:
  • Limited to the minimum necessary scope.
  • Fully logged, monitored, and auditable for accountability.

Principles of Least Privilege

Rhombus enforces least-privilege access for both customers and internally.
  • Role-based access control (RBAC) ensures users only have the permissions required to perform their roles.
  • Temporary, time-bound access is provided for limited support activities.
  • Internal employee accounts are restricted and reviewed regularly to prevent privilege creep.
These measures reduce the likelihood of misuse, whether accidental or intentional.

Defense in Depth

No single safeguard is enough on its own. Rhombus employs a defense-in-depth strategy that layers multiple controls to protect against a wide range of threats.
  • Hardened firmware and secure boot processes on devices.
  • TLS encryption for communications between devices, applications, and the cloud.
  • AWS-native controls such as VPC segmentation and DDoS protection.
  • Continuous monitoring and automated alerting for suspicious activity.
This layered approach ensures that even if one control is bypassed, others remain in place to maintain protection.

Secure by Default

Rhombus products are secure straight out of the box. Customers benefit from strong protections without needing to configure them manually.
  • Devices ship with no open inbound ports.
  • Encryption is automatically enabled for data in transit and at rest.
  • Automatic firmware and software updates are enabled by default, ensuring vulnerabilities are patched quickly.

Resilience and Reliability

Security and reliability go hand in hand. Rhombus designs systems for high availability and business continuity.
  • Cloud backups protect against local data loss.
  • Physical and visual tamper detection features provide rapid alerts when devices are compromised.
  • Redundant infrastructure ensures services remain available, even during disruptions.
These measures provide confidence that customer operations remain continuous and resilient, even under stress.

Foundation for Compliance

By embedding secure design principles into every layer of its platform, Rhombus provides customers with systems that naturally support compliance with regulatory and industry standards. These principles enable alignment with:
  • SOC 2 trust services criteria.
  • HIPAA safeguards for PHI.
  • GDPR requirements for personal data protection.
  • CCPA/CPRA consumer privacy obligations.

 

Encryption & Data Protection

Encryption is a cornerstone of Rhombus's approach to safeguarding customer data. From the moment data is captured on a device to its storage in the cloud or eventual deletion, Rhombus applies strong cryptographic protections to ensure confidentiality, integrity, and availability. These protections are applied consistently across the entire data lifecycle and are designed to align with industry and regulatory standards.

Encryption at Rest and in Transit

Customer data is always encrypted, whether stored locally on a device or transmitted to the cloud.
  • At Rest: AES-256 encryption protects data stored locally on devices using Linux Unified Key Setup (LUKS) and data stored in the cloud through AWS Server-Side Encryption with Key Management Service (SSE-KMS).
  • In Transit: Communications between cameras, sensors, mobile apps, and cloud services are protected using TLS 1.2 or higher, with TLS 1.3 support where available.
These measures ensure that data cannot be intercepted or accessed without authorization.

Encryption Standards

Rhombus follows cryptographic standards that are widely recognized and approved by regulators:
  • AES-256 for secure data storage.
  • TLS 1.2+/TLS 1.3 for secure communication channels.
  • SHA-256 or stronger for message integrity and hashing.
By following NIST-recommended standards, Rhombus ensures that encryption methods are both modern and defensible.

Key Management

Rhombus uses AWS Key Management Services (KMS) to manage encryption keys securely.
  • Automated key rotation ensures keys are refreshed regularly.
  • Role-based access controls limit who can interact with keys.
  • Segregation of duties prevents any single individual from having full control over data and its keys.
  • Auditable logs provide traceability of all key usage.
This layered approach reduces risk and provides assurance that encryption controls remain effective over time.

Data Lifecycle Protection

Rhombus protects data through every phase of its lifecycle:
  • Creation: Data is encrypted at the moment of capture on devices.
  • Transmission: Video and metadata are encrypted during transfer to the cloud.
  • Storage: Cloud and device data remain encrypted at rest.
  • Deletion: Data is securely deleted once retention periods expire, ensuring it cannot be recovered.
By applying encryption consistently from creation through deletion, Rhombus minimizes the risk of unauthorized disclosure.

Segregation of Customer Data

Operating in a multi-tenant cloud environment requires strong safeguards to ensure customer data remains isolated. Rhombus achieves this by:
  • Assigning unique encryption keys to each customer.
  • Applying logical data separation within cloud storage.
  • Ensuring that compromise of one tenant does not affect another.
This separation is critical for maintaining confidentiality in shared environments.

Device-Level Security

Rhombus devices are designed with trust at the hardware and firmware level.
  • Each device is provisioned with a unique digital certificate that authenticates it to the Rhombus Cloud.
  • Devices ship hardened with no open inbound ports.
  • Firmware and software updates are digitally signed and verified before installation.
These measures ensure only trusted devices can connect and remain secure throughout their lifecycle.

Tamper Protection and Device Trust

Devices are equipped to detect and respond to tampering.
  • Physical tamper alerts notify customers within seconds if a device is disturbed.
  • Visual tamper alerts notify customers when a camera's view is obstructed.
  • Device logs provide a full record of activity for auditing and investigation.
These features reinforce confidence that Rhombus devices remain trustworthy, even in physically exposed environments.

Compliance Alignment

Encryption and data protection controls at Rhombus support compliance with a wide range of regulatory frameworks:
  • SOC 2: Confidentiality and logical separation of customer data.
  • HIPAA: Protection of PHI/ePHI through encryption and access controls.
  • GDPR: Data encryption to support privacy and protection mandates.
  • CCPA/CPRA: Technical safeguards supporting consumer privacy rights.
  • PIPEDA: Encryption and lifecycle management for Canadian privacy compliance.
  • NIST SP 800-53: Alignment with federal encryption and data protection standards.
By aligning encryption practices with these frameworks, Rhombus ensures that customers can deploy our solutions in highly regulated industries with confidence.
 

Secure Operations and Maintenance

Maintaining a strong security posture requires more than just design -- it requires disciplined, ongoing operational practices. Rhombus follows industry best practices for secure operations, ensuring that infrastructure and devices remain resilient, up to date, and capable of withstanding evolving threats. By combining automation, layered protections, and continuous monitoring, we provide customers with confidence that their systems remain secure and available at all times.

Automatic Updates

Rhombus devices and services are updated automatically, reducing the window of exposure to vulnerabilities. All updates are cryptographically signed and verified to ensure authenticity before deployment.
  • Signed Firmware & Software Updates: All updates are cryptographically signed and verified before installation. Prevents unauthorized code from being installed on devices.
  • Automated Deployment: Updates are deployed automatically, ensuring that security patches are applied consistently and without customer intervention.
  • Frequency: Updates are delivered continuously, typically on a monthly cadence or sooner if critical vulnerabilities are identified.
This process ensures that customers benefit from the latest protections with minimal effort.

Infrastructure Hardening

The Rhombus cloud environment is hosted on Amazon Web Services (AWS), which provides a secure and resilient foundation. Additional layers of protection are applied to strengthen the environment further:
  • Virtual Private Clouds (VPCs) to segment workloads and isolate resources.
  • DDoS protections to prevent disruption from denial-of-service attacks.
  • Multi-tenant Isolation to ensure customer data is strictly segregated.
  • Redundancy and availability zones to provide resilience against outages.
In combination, these measures safeguard customer systems against both external attacks and operational disruptions.

Monitoring and Logging

Comprehensive monitoring provides visibility into activity across the platform and enables rapid detection of threats.
  • Detailed logging of system and user activity, including authentication, configuration changes, and video access.
  • Customer visibility through the Rhombus Console, giving administrators accountability and audit support.
  • Automated anomaly detection to flag suspicious behavior such as unusual login patterns or unauthorized configuration attempts.
  • Real-time alerting sent to Security teams receive real-time alerts for potential threats, enabling rapid investigation.
This combination of customer-facing transparency and behind-the-scenes monitoring provides strong accountability and proactive defense.

Incident Response and Business Continuity

Rhombus maintains a tested incident response framework and continuity planning to ensure resilience even in the event of a security incident.
  • Documented response procedures guide consistent, rapid handling of incidents.
  • Backup and recovery mechanisms ensure customer data can be restored quickly.
  • Transparent communication is provided to customers in the event of a confirmed incident affecting their data.
By preparing in advance, Rhombus ensures issues are contained quickly and services are restored with minimal impact.

Compliance Alignment

Secure operations at Rhombus are mapped to leading industry and regulatory frameworks, including:
  • SOC 2: Operational controls, audit logging, and incident response practices.
  • HIPAA: Monitoring and patching safeguards to protect PHI.
  • NIST SP 800-53: Federal cybersecurity operational requirements.
  • GDPR & CCPA/CPRA: Transparency and accountability in how systems are operated and monitored.

 

Third-Party Validation and Compliance

Independent validation and regulatory alignment are central to building trust. Rhombus not only designs its systems to be secure but also subjects its programs to external audits, independent testing, and compliance reviews. In addition, we conduct internal audits to ensure that our security and privacy practices remain effective, relevant, and continuously improving. These steps demonstrate our ongoing commitment to accountability and transparency.

Independent Assessments and Certifications

Rhombus validates its security posture through both internal and external reviews.
  • SOC 2 Audits: Rhombus has achieved its SOC 2 Type I certification, verifying the design of key security, availability, and confidentiality controls. Work toward SOC 2 Type II is ongoing, with reports made available to customers under NDA.
  • Third-Party Penetration Testing: Annual penetration tests are performed by independent security firms. All findings are remediated, retested, and tracked to ensure closure. Summaries of results are available under NDA.
  • Internal Audits: Regular internal audits are performed to verify compliance with security controls, review system configurations, and identify opportunities for improvement.
These activities ensure that both independent assessors and Rhombus's own governance processes validate the strength of our program.

Regulatory and Legal Compliance

Rhombus aligns its practices with leading international privacy and security frameworks so customers can confidently use our solutions across regulated industries:
  • NDAA/TAA: Devices use compliant chipsets and exclude banned components.
  • HIPAA: Technical and administrative safeguards protect PHI and ePHI.
  • GDPR: Features support lawful processing, subject rights, and data breach notification.
  • CCPA/CPRA: Consumer privacy rights are supported with transparency and deletion capabilities.
  • PIPEDA: Encryption and lifecycle controls support Canadian privacy obligations.
  • BIPA: Biometric data protections include opt-in consent and secure handling.
  • NIST, CMMC, and CJIS: Practices align with federal cybersecurity frameworks and requirements for defense and law enforcement customers.
By mapping security controls to these standards, Rhombus ensures its platform can be deployed confidently in environments with strict compliance obligations.

Supply Chain and Vendor Risk Management

Rhombus recognizes that security depends on the integrity of the supply chain. To safeguard customers, we:
  • Evaluate suppliers and partners for security and compliance risks.
  • Require contractual assurances that vendors meet Rhombus's security standards.
  • Monitor suppliers for ongoing risks and maintain approved sourcing practices.
This diligence ensures that hardware and services meet both quality and regulatory expectations before reaching customers.

Data Retention and Disposal

Rhombus enforces strict data lifecycle protections to minimize risk.
  • Data is retained only for as long as legally or operationally required.
  • At the end of its lifecycle, data is securely deleted to prevent recovery.
  • Disposal of both physical and electronic media follows industry best practices.
These measures support compliance with SOC 2, GDPR, HIPAA, and other frameworks that require secure handling of information from creation through destruction.

Transparency and Documentation

To support customer assurance programs, Rhombus provides documentation under NDA, including:
  • SOC 2 reports.
  • Penetration test summaries.
  • Security questionnaires and compliance mappings.
Customers may request these materials through Rhombus Support or their account representative.

Compliance Alignment

Rhombus's practices and controls are aligned with recognized standards and frameworks:
  • SOC 2 Trust Services Criteria for security, availability, and confidentiality.
  • NIST SP 800-53 for federal cybersecurity alignment.
  • HIPAA Security Rule safeguards.
  • GDPR and CCPA/CPRA privacy requirements.
This alignment ensures that Rhombus's program is defensible, auditable, and trusted across industries.

 

Company-Level Security Practices

At Rhombus, security is not just about technology -- it is also about how we operate as an organization. Our internal practices ensure that employees, contractors, and systems all follow strict security protocols designed to protect customer data and maintain compliance with industry standards. By combining access controls, cultural reinforcement, and continuous monitoring, we ensure that our workforce upholds the same high level of security that we deliver in our products.

Employee Access Controls

All access to internal systems is governed by strong authentication and authorization measures. Access is restricted according to job role and reviewed regularly to prevent over-provisioning.
  • Multi-Factor Authentication (MFA) is required for all internal systems and administrative access.
  • Role-based access control (RBAC) enforces least-privilege, ensuring employees only have the access necessary for their responsibilities.
  • Access reviews are conducted periodically to verify the appropriateness of user permissions.
  • Immediate revocation of access occurs when roles change or employment ends.
This approach ensures that only authorized individuals have access to secure systems required for their role.

Security Monitoring

Rhombus continuously monitors its internal environment for anomalies and potential threats. Automated alerts and dedicated oversight allow for rapid response to suspicious activity.
  • Anomalous login behavior (e.g., unusual geolocation or time-of-day patterns) is flagged and investigated.
  • Privileged account activity is closely monitored for signs of misuse.
  • Internal logs are reviewed to ensure compliance with company policies and to detect insider threats.

Security Culture

Technology alone is not enough -- a strong security posture depends on people. Rhombus promotes a culture where every employee understands their role in safeguarding data.
  • Mandatory security awareness training is provided to all employees upon hire and refreshed regularly.
  • Periodic tabletop exercises test readiness for incidents and reinforce best practices.
  • Clear policies and standards ensure that security responsibilities are well understood at every level.
This cultural focus ensures that security is embedded in everyday operations.

Accountability and Transparency

Rhombus enforces accountability across all internal practices:
  • All employee activity is logged for auditability and traceability.
  • Enforcement actions are applied consistently in cases of policy violations.
  • Transparency with customers and partners ensures confidence in how internal practices support external trust.

Compliance Alignment

Company-level security practices are a critical component of Rhombus's overall compliance program. These measures directly support requirements in:
  • SOC 2: Logical access controls, monitoring, and employee accountability.
  • HIPAA: Administrative safeguards protecting PHI and ePHI.
  • GDPR & CCPA/CPRA: Organizational measures to support lawful, secure data handling.
  • NIST SP 800-53: Federal requirements for personnel and operational security.

 

Security FAQ

Customers often have specific questions about how Rhombus protects their data and ensures system security. This FAQ addresses the most common inquiries, providing clear answers backed by our security architecture and operational practices. Each response is designed to give customers confidence that Rhombus's commitments to transparency, protection, and compliance are upheld in practice.

Do Rhombus employees have access to my video or data?

No. Customers fully control who has access to their systems and data. Rhombus employees cannot view customer video or metadata unless explicit authorization is granted for support purposes.
  • Any authorized access is time-bound, limited in scope, and performed only when necessary.
  • All actions taken by Rhombus personnel are logged and auditable for accountability.

How are encryption keys managed?

Encryption keys are managed through AWS Key Management Service (KMS) with strict security controls in place.
  • Keys are rotated regularly and automatically to minimize risk.
  • Role-based access controls ensure only authorized personnel can interact with keys.
  • Segregation of duties prevents any one individual from having full control over both data and keys.
  • All key activity is logged for auditability.

How quickly are tamper events detected?

Rhombus devices are equipped with tamper detection capabilities to notify customers promptly of potential compromise.
  • Physical tamper alerts are typically generated within 2-4 seconds.
  • Visual tamper alerts notify customers within approximately 30 seconds if a camera's view is obstructed.
  • Cloud backups run continuously, with data replication generally within 4 minutes of capture.

Is Bluetooth secure on Rhombus devices?

Yes. All Bluetooth communications use mutual authentication and encryption, ensuring that only trusted devices can connect. This prevents unauthorized pairing and protects against interception.

What about compliance with COPPA and child privacy protections?

Deployments in environments involving minors are subject to additional protections.
  • Parental or organizational consent is required where applicable.
  • All data remains encrypted at rest and in transit.
  • Rhombus employees cannot access customer data unless explicitly authorized, and such access is fully logged.

Does Rhombus comply with privacy regulations like GDPR and CCPA?

Yes. Rhombus systems and processes are aligned with global privacy regulations.
  • GDPR: Customers benefit from features supporting data subject rights, lawful processing, and breach notification.
  • CCPA/CPRA: Rhombus supports consumer privacy rights such as transparency, access, and deletion.

Helpful Links

Contact Support or Sales

Have more questions? Contact Rhombus Support at +1 (877) 746-6797 option 2 or support@rhombus.com.

Interested in learning more? Contact Rhombus Sales at +1 (877) 746-6797 option 1 or sales@rhombus.com.

Related articles

Comments

0 comments

Please sign in to leave a comment.

Powered by Zendesk