Who we are
Rapitt is built and operated by RapitAI, Dubai, United Arab Emirates. Questions about this notice or about your data go to [email protected].
Each organisation that uses Rapitt has its own workspace at an address such as
yourcompany.rapitt.ai. That organisation decides which servers, devices and people its
workspace watches and who may sign in to it. RapitAI processes that data on the organisation's behalf,
to provide the service.
This website
rapitt.ai sets no cookies of its own and carries no analytics, advertising or tracking. Two other companies are involved in showing it to you:
- Cloudflare carries every request to rapitt.ai and its workspaces and protects them from attacks. Like any network provider, it sees your IP address and the pages you request.
- Google Fonts serves the Inter typeface the pages use, so your browser asks Google for it.
The demo request form
When you ask for a demo we receive your name, work e-mail address, company, phone number (if you give one), the size of your organisation and the workspace address you would like. We also record the IP address and browser the request came from, which is how the form limits abuse (five requests per visitor per hour).
The request is stored and e-mailed to our team, and used only to reply to you and to set up your workspace. We do not sell it, and we do not add you to a mailing list. It is kept as a record of the request until you ask us to delete it.
What a workspace records
Servers. On a fixed interval Rapitt records whether each server answers, whether its login works, CPU, memory and disk use, the operating system, certificate expiry dates, websites, services and database engines and their state, network interfaces and traffic, listening ports, and security settings such as updates, antivirus, firewall and encryption. It signs in to the server with credentials the organisation stores in its workspace; those credentials are never written into a reading.
Workstations, where the organisation installs the endpoint agent: the machine's CPU, memory and disks, its security settings, the desktop applications installed on it, and how long each application was in use. Usage is measured by sampling which window is in front, and idle and locked time is discarded, so the figure is attention rather than the hours the machine was on.
The agent does not collect keystrokes, screenshots, the clipboard, file contents or browsing history. The most it reads is the title of the window in front, and the organisation can switch that off. The agent keeps a readable log on the machine itself, so anyone can see what their computer sent.
Devices such as printers, attendance terminals, routers and Wi-Fi equipment: whether they answer, and the status they report (toner, counters, firmware and similar). From attendance terminals Rapitt reads how many users and records they hold, never who they are.
Accounts and sign-in
You sign in with your Microsoft account; Rapitt never sees your password. From Microsoft we receive your name, your e-mail address and the identifiers of your account and its organisation, which is how Rapitt recognises you on later sign-ins. A sign-in starts a session that lasts 24 hours and that you or an administrator can end at any time. Signing in proves who you are; an administrator of the workspace still decides whether you get in and what you can see.
Each workspace keeps an audit trail of sign-ins, configuration changes, permission changes and actions taken on servers, with who did it, when and from which IP address.
Where it is kept and how it is protected
- Each workspace has its own database, its own encryption key and its own processes. One organisation's data is never stored with another's.
- The databases accept no connection from the network; only the Rapitt service on the same server can reach them.
- Passwords, keys and other secrets an organisation stores are encrypted at rest with AES-256-GCM.
- Every connection from your browser travels over HTTPS.
Who else handles data
Besides Cloudflare and Google Fonts above, data reaches other companies only for the purposes below. Some happen only when an organisation switches the feature on.
- Microsoft: signing you in, and delivering Rapitt's e-mail through Microsoft 365.
- SMS and WhatsApp providers: only if the organisation sends alerts that way. They receive the alert text and the recipient's phone number.
- Anthropic: only when an administrator runs a root-cause analysis on a server. The diagnostic evidence collected from that server is sent to Anthropic's Claude API to write the report.
We do not sell personal data, and we do not use workspace data for advertising.
How long it is kept
- Server readings: 30 days by default, then deleted automatically. Each organisation can change this.
- Network traffic samples: deleted on the same schedule.
- ERP posting history: 90 days by default.
- Deleted servers, VPNs and clients keep their history until an administrator deletes them permanently, so a mistaken deletion can be undone.
- Demo requests: until you ask us to delete them.
Your choices
To see, correct or delete data about you, write to [email protected]. If your employer's workspace monitors your computer, your employer controls what it collects; ask them first, since they can show you exactly what is stored and switch collection off.
Changes to this notice
When what Rapitt collects or shares changes, this page changes with it and the date at the top moves.