Security of data and communications is a global priority in humanitarian projects. Therefore, it is our no.1 priority in RedRose.

• External audits and GDPR compliance: We are GDPR-compliant both as an organization and as a data-management system. The latter is independently verified by Ernst & Young (EY) while the former is verified by PwC who have evaluated RedRose’s governance as ‘in line with best practice’. We reassure our partners by performing the external audit process each year.
• Secure cloud environment: Our solution is cloud-based, and each mission is hosted on an isolated space in Amazon Web Services (AWS), known as the leader in global IT infrastructure. In addition to the security and redundancy provided by AWS, we operate firewalls, intrusion detection systems, and an array of other technological safeguards to meet security certification standards.
• Strong encryption at all levels: All communications between users, apps and our platform are encrypted by industry-standard SSL, and a full audit trail (including error logs) is available on all transactions, client content and form development. The device and cloud databases are encrypted and the exchange of information between the terminal and the server uses both SSL and TLS protocols. RedRose stores data on the AWS cloud platform which encrypts all customer content stored at rest, without any action required from the customer, using one or more encryption mechanisms (AES).
• Strict data storage strategies: The RedRose app uses a uniquely keyed AES256 encrypted database on Android and has a data storage strategy of not holding any data which is not necessary for the usage purpose. For example, vendor devices do not have any access to beneficiary data and do not store any portion of it. They just store card IDs and transaction amounts. On the field staff devices can process sensitive data (mainly they collect it), but once it is synced safely, that data is automatically removed from the device.