How RudderStack handles customer data in transit

Recent coverage of data practices in consumer health apps has prompted questions about RudderStack's role as a data infrastructure vendor in this space. We want to answer those questions plainly, because the way RudderStack has been described in some reporting does not accurately reflect what we are or how we work.

RudderStack is infrastructure, not an analytics company

RudderStack is a customer data pipeline. We are not an analytics company, and we are not a data broker.

The distinction is not semantic. An analytics company stores data to surface insights: dashboards, reports, behavioral analysis. A data broker collects and monetizes data as its business model. RudderStack does neither. We route customer data from a source to a destination the customer has configured. Our business model is software: customers pay us for the pipeline, not for access to their data.

When RudderStack appears in discussions about how apps handle user data, it is because an app has chosen to use RudderStack as its data infrastructure, in the same way a company might choose AWS as its cloud infrastructure or Snowflake as its data warehouse. The infrastructure provider is not the decision-maker about what data is collected or where it goes. The app is.

What happens to data when it passes through RudderStack

When a company uses RudderStack, data moves from a source (a mobile app, a website, or a server) through our pipeline to a destination the customer has configured. That destination is always something the customer controls or has chosen: their own data warehouse, an analytics tool, or another system in their stack.

RudderStack does not decide what data a customer collects. RudderStack does not decide what destinations that data is sent to. Those are configurations the customer sets up in their own RudderStack workspace, under their own account.

Data is in transit through our system for the time required to process and route it. By default, we do not store customer data, and data is purged within hours of processing. Once data reaches its destination, it is no longer in our systems.

What RudderStack does not do

Here is what we don’t do:

We do not sell customer data. Our revenue comes from software subscriptions. We have no mechanism for and no interest in monetizing the data that passes through our pipeline.

We do not use customer data for our own purposes. Data that flows through RudderStack belongs to the customer. We process it only as the customer instructs, for the purpose of routing it to the destination the customer has configured.

We do not share customers’ personal data with third parties. What destinations a customer routes data to is the customer's decision, configured by them. RudderStack routes data to those destinations on the customer's instruction.

We do not decide what an app collects. What a company chooses to collect from its users, and what it discloses in its privacy policy about that collection, is the company's responsibility. RudderStack processes the data it receives; it does not control what is sent.

On data security and encryption

Data transmitted between a customer's application and RudderStack is encrypted using standard TLS, as is data transmitted between RudderStack and downstream destinations. Within our pipeline, data is processed in order to transform and route it correctly: transformation, formatting for the destination, and delivery. This is true of any data pipeline; you cannot route or transform data you cannot read.

RudderStack is SOC 2 Type II certified, HIPAA compliant (we can sign a Business Associate Agreement), and GDPR compliant. We conduct regular third-party audits of our security policies and procedures. Our architecture is designed so that RudderStack personnel cannot access customer data transiting through the platform.

Our warehouse-native model and data ownership

RudderStack is built on a warehouse-native architecture, and it is worth explaining what that means in practice.

Traditional customer data platforms work by copying your data into the vendor's own cloud, creating a second copy you do not control, governed by that vendor's retention, security, and access policies. Your customer data sits in someone else's infrastructure, subject to someone else's governance decisions.

RudderStack works differently. Data flows to the customer's own data warehouse: Snowflake, BigQuery, Redshift, Databricks, or whichever warehouse the customer uses. The customer owns that warehouse, controls access to it, and retains full ownership of the data in it. RudderStack does not have access to the customer's warehouse. There are no shadow copies of your data sitting in a vendor's system. When regulators or auditors ask where your data lives, the answer is straightforward: it lives with you.

This is a deliberate architectural choice. Customers are not dependent on RudderStack as a long-term custodian of their data.

On compliance

RudderStack gives customers the controls to meet their own compliance obligations: consent management, data-governance tooling, and the ability to keep sensitive data in their own warehouse rather than routing it to third-party systems. Customers handling sensitive data categories, including health information, can use these tools to control precisely what data flows to which destinations.

RudderStack provides tooling, not legal advice, and compliance remains each customer's responsibility. We also encourage customers to review their privacy policies to ensure that their data infrastructure vendors, including RudderStack, are disclosed appropriately to their users. Transparency about the tools a company uses is good practice and, in many jurisdictions, a legal requirement.

If you have questions about how your specific RudderStack integration handles data, or want to review your configuration with our team, contact us.

For security inquiries, visit our Vulnerability Disclosure Policy. For compliance and legal questions, visit our security page or reach out directly.