Security and Trust

Rhombus secures the platform your integration calls; your integration secures its credentials, its endpoints and what it does with the data. This page covers both sides, and where to find Rhombus's compliance documentation.

Report a vulnerability

Email security@rhombussystems.com with what you found, the steps to reproduce it, and its impact. Test only against your own organization, and don't access or change other customers' data. The same contact is published in security.txt, and the policy is on the Trust Center.

For an exposed credential of your own, such as an API key committed to a public repository, don't wait: delete the key in the console and create a new one (Rotate an API key). Deleting a key or revoking an OAuth grant takes effect within 60 seconds on every host, and open WebSocket and media connections that use it are closed. Federated tokens minted with that key or grant stop working too, and a single leaked federated token can be revoked on its own (Federated tokens).

Compliance

Rhombus's security and compliance program covers SOC 2, NDAA, GDPR and TAA. Reports, certificates, and security and privacy documentation are on the Trust Center.

Data residency

Every organization lives in one region, US or EU. An organization provisioned in the EU is hosted in the European Union: its API traffic, video storage and cloud processing stay in the region. Credentials are region-bound, so a US key or token doesn't work on EU hosts. API regions lists each region's hosts.

How this site measures usage

This site records anonymous usage to improve the documentation: the pages read, searches and the results chosen, questions asked to Ask AI, and the API operations sent with Try it (the operation and its status only, never parameters, bodies or keys). It sets no cookies and keeps nothing that identifies you. Anything that looks like a key or an email address in what you type is removed before it's stored, and the data stays in Rhombus's own systems.

Transport security

Every Rhombus API, media and WebSocket endpoint uses TLS: media is served over HTTPS and secure WebSockets. Cameras on your local network serve their streams over HTTPS on port 8000, at hostnames such as 192-168-1-50.lan.rhombussystems.com that resolve to the camera's local address.

Network endpoints

To allow an integration through a firewall, open outbound HTTPS to these hosts (EU organizations use the .eu. hosts listed in API regions):

Webhooks travel the other way: Rhombus connects to your HTTPS endpoint. Authenticate them by their signature, not by source address.

Your integration's responsibilities

• Keep API keys on servers. Browsers, mobile apps and anything users can inspect get short-lived federated tokens, scoped to a device where possible and bound to your site's origin with domain when they're used in a browser.
• Give each integration its own key with the narrowest role that works, and rotate keys on a schedule and whenever one may have leaked (Permissions and key rotation).
• Verify every webhook before acting on it, and serve your receiver over HTTPS (Webhook receivers).
• Put a person in the loop for physical actions. Unlocking doors, lockdowns and alarm escalation deserve their own key and, when triggered by automation or an AI assistant, a human approval step. An OAuth app that doesn't need them leaves out the physical scope (Sign in with Rhombus).
• Treat data from Rhombus as sensitive. Payloads, footage and tokens name people and places: keep them out of shared logs and analytics, and apply your own retention rules.
• Watch the audit log. Actions taken with an API key are recorded under the key's name (Audit trail).