Schedule C | Operational Security and Controls
Version 3.0 applies only through valid acceptance of the online MSA or a valid amendment. A private commercial order and provider approvals remain separate.
C.1 Proportionate safeguards
Each party must maintain administrative, technical and organizational safeguards appropriate to the data, systems and risks for which it is responsible. Merchant must use unique users, least privilege, multifactor authentication where offered, controlled administrator access, confidential staff/vendor obligations, secure device practices, timely patching and prompt access removal when roles end. Shared support or administrator credentials should not be used to authorize a financial or security change without verification.
C.2 Integration controls
Keep secrets server-side in protected storage; do not place API secrets or private keys in browsers, public repositories, ordinary documents or support chats. Use current supported encrypted transport, verify certificates and webhook signatures, reject invalid/replayed messages and apply idempotency, access restrictions, logging and reconciliation appropriate to the integration. Logs must omit sensitive authentication data and minimize personal information.
C.3 Incidents
Notify security@rt.app without undue delay and no later than 24 hours after awareness of an actual or reasonably suspected incident affecting the Services. Preserve relevant logs and evidence, contain the event, revoke compromised credentials and supply known facts, likely impact and actions taken, followed by updates. Do not delay notice until confirmation or final forensic conclusions. Required notices to providers, regulators and affected individuals remain the responsible party's duty.
C.4 Investigation and recovery
Merchant must cooperate with proportionate RT/provider investigations and network-mandated independent forensics, limit further exposure and verify remediation before restoring unsafe activity. RT may restrict access or payment functionality during response. Costs follow causation, provider requirements, indemnity and mandatory law; a suspected incident is not itself proof of Merchant fault or a license to retain unrelated funds.
C.5 Assurance and limitations
Any evidence RT supplies may be reasonably redacted for security and confidentiality. This schedule makes no assertion that RT currently holds SOC 2, PCI Level 1 or another certification, operates a particular backup frequency, or promises specified recovery/uptime targets. A particular assurance requires current evidence or an express signed commitment. PCI obligations depend on actual data handling and provider requirements; hosted fields do not automatically prove any particular SAQ eligibility.
C.6 Data and access review
Maintain appropriate access, backup, recovery and retention procedures for systems under each party's control. Review privileged access periodically and after personnel changes. Do not add customer or staff identifiers to public-chain metadata; necessary public wallet/transaction references require a lawful basis, minimization and clear disclosures. Account-owner verification, recovery channels and signing authority are separate controls; a logged-in mailbox or DocuSign profile name is not proof of legal authority.