Security & GDPR
Your data. Under European law.
rinqo doesn't store data on US servers. We don't use US tracking pixels or US CDNs. What rinqo processes for you stays in the EU.
Four pillars. No compromises.
Hosted in Germany
All data sits on servers in Germany, with backups in the EU. The data processing runs entirely in the EU. Every contract runs under European law and European jurisdiction.
Encrypted where it matters
You can only reach the website and dashboard over an encrypted connection, using TLS 1.2 or 1.3; the servers refuse older protocols. Credentials for your systems are stored encrypted with AES-256-GCM, passwords are hashed with bcrypt. The backup kept off the server is encrypted before it is transferred.
Processing in the EU
Our primary AI sub-processor processes all content within the EU, contractually guaranteed, and does not use it for training. Speech recognition and speech synthesis run through services with EU processing. A European fallback provider stands by for the language model. The named provider list is available to customers in the dashboard.
DPA included
The Data Processing Agreement (DPA) under Art. 28 GDPR comes with every account, and you accept it when you sign up. No paperwork sent later, no extra package.
The hard facts.
Shadow AI: You probably already have the problem.
If your team has no approved AI tool, it uses its own. Four in ten companies in Germany assume their employees use private AI accounts at work. Only about a quarter have any rules for it at all (Bitkom, October 2025). Company data then ends up with US services, without a contract, without control.
This is not a discipline problem, it is a supply problem. Whoever provides an approved, GDPR-compliant alternative solves it. With rinqo, every team member can get their own Personal Agent on European infrastructure, without US providers, with access to your company knowledge instead of the open web. Shadow AI loses its reason to exist.
Read the study: Shadow AI in SMEsData ProcessingAgreement (DPA).
Every rinqo account automatically enters into a DPA under Art. 28 GDPR, and all subprocessors are documented. You need the DPA for your own documentation duties, so we include it. On request you receive all your data within 14 days (Art. 20 GDPR), and you can delete it yourself in the dashboard at any time.
EU AI Act. On by default.
Since 2 August 2026, Art. 50 of the EU AI Act requires that people are told when they are talking or writing to an AI. With rinqo this notice is on by default: always visible in the chat window, below every email from the agent, and on the phone in the preset greeting. If you change the greeting, the AI notice belongs in your own text.
Open AI transparency pageInformation pursuant to Art. 28 of Regulation (EU) 2023/2854 (Data Act)
The ICT infrastructure used to provide our data processing services is subject to the jurisdiction of the Federal Republic of Germany and the European Union; hosting takes place in data centres in Germany, with backups in the EU. Against unlawful governmental access from third countries, we take in particular the following measures: contractual partners established in the EU, data processing exclusively within the EU (contractually guaranteed), encrypted transmission (TLS), encrypted storage of access credentials for connected services (AES-256), access on a need-to-know basis, and legal review of every official disclosure request before any information is released.
When the agent gets it wrong
The agent is bound to your approved knowledge base, and its answers are checked against it. Mistakes are still possible. That is why every conversation is logged: you can see at any time what was said and correct the knowledge in one place. If it finds no answer, it says so and passes the request to your team instead of guessing. For regulated matters (medicine, law, tax): the agent records and forwards, it does not advise. For health data you sign a supplementary agreement before going live, and section 10 of the DPA applies to professional secrets. rinqo staff access conversation content only at your request in a support case, and access is logged. You are responsible for the content of your knowledge base, we are responsible for the technology, the details are governed by the DPA.
Oursubprocessors.
All subprocessors are based in the EU or have EU subsidiaries with their own DPAs. Transparently documented. On request, we provide the complete named list together with the DPA template before the contract is signed. Transparently documented:
As a customer, you get the complete list with company names, legal entities and legal bases directly in the dashboard. Prospective customers receive it on request as part of the contract process.
Certifications. Documented honestly.
We don't believe in marketing badges that mean nothing. Here's the current status, open and without greenwashing. All artefacts go to customers who need them for their own vendor review.
GDPR compliance
ImplementedDPA under Art. 28, data export (Art. 20), deletion concept (Art. 17).
ISO 27001 (information security)
Not certifiedOur technical and organisational measures align with the standard. There is no certification.
SOC 2 Type II
Not certifiedMainly relevant for US customers with enterprise requirements. No report is available.
EU AI Act (Art. 50 transparency)
ImplementedAI notice on by default in chat, email and the preset phone greeting, generated images marked in their metadata, templates for your website.
Penetration test (external)
Planned 2026First pen-test after stable launch by an independent EU security firm. Report available to customers under DPA on request.
Privacy questions?
Write directly to our data protection contact. We answer within 24 hours.