Trust & Security

• Provider: Hetzner Online GmbH — EU entity, German data protection law applies.
• Region: Hetzner Falkenstein (Germany) — primary hosting and data storage in an EU data center. Any third-country transfer (e.g. edge protection, optional identity federation) is limited to the sub-processors listed in the sub-processor register below, each under EU Standard Contractual Clauses.
• Database: Managed relational database, encrypted at rest (AES-256), TLS 1.3 in transit.
• Backups: Daily encrypted backups, 30-day retention, stored within EU.
• DPA: We sign a Data Processing Agreement on request — dpo@rakomi.com.

• Last internal security assessment: April 2026 (self-assessed — not an independent audit)
• Standards: GDPR Art. 32, NIS2 Art. 21, ISO 27001 A.8.29
• Assessment result: PASS — no critical vulnerabilities outstanding
• Test scenarios: 148 automated tests across authentication, session management, multi-tenant isolation, supply chain, and continuous integration
• Security measures: Industry-standard memory-hard password hashing, asymmetric cryptographic signing for all tokens, automated vulnerability scanning on every pull request
• Data residency: Primary processing and storage in the EU (Germany); any third-country transfer is limited to the sub-processors in the register below, each under EU Standard Contractual Clauses
• Next scheduled assessment: Before general availability release

Our responsible disclosure programme is open — see /security. All reported vulnerabilities are tracked and remediated under our defined SLAs.

The EU Agent Accountability Chain

Every action an AI agent takes on your behalf is recorded, made tamper-evident, and — link by link — mapped to the exact EU regulation it satisfies. Read the chain top to bottom; each node names what it does and what proves it.

1. GDPR Art. 7(3)AI Act Art. 14 Live

   First-class agent identity

   Every AI agent is separately registered, revocable, and audited. Each of your end-users can withdraw consent for an individual agent as easily as it was given — and a human stays in oversight of what agents may do.

   ↓
2. GDPR Art. 5(2)GDPR Art. 30AI Act Art. 12 Live

   Per-agent tamper-evident hash chain

   Every agent action is recorded, and each record is cryptographically chained to the one before it (180-day retention) — so any later alteration is detectable. This is how we demonstrate accountability and keep records of processing.

   ↓
3. GDPR Art. 32GDPR Art. 33 (breach evidence) Live

   Dual-write to the immutable archive

   Critical events are dual-written to a separate immutable archive, retained for a minimum period determined by the accountability obligation it serves, and potentially longer while that obligation subsists. This hardens the security of processing and provides supporting evidence should a breach ever need to be reconstructed — it does not by itself satisfy any breach-notification duty.

   ↓
4. Tamper-evidenceeIDAS2 / EUDI (roadmap) Roadmap

   Daily summary independently anchored

   A daily summary of the chain will be independently anchored to third-party-operated public timestamping and archival services (such as OpenTimestamps and Software Heritage) — a proof-of-existence in a public timechain paired with an independent EU-domiciled archive, two different guarantees, independently verifiable by anyone without trusting Rakomi. A future qualified-ledger upgrade (eIDAS2 / EUDI, Regulation (EU) 2024/1183 amending Reg. (EU) No 910/2014) is roadmap only, not a present claim.

   This independent anchoring is supplementary, freely-verifiable evidence that the agent-action record existed at a given time and has not been altered since. It is not a paid trust-service timestamp carrying a statutory legal presumption of correctness — that is a deliberate, context-justified future option, not a claim we make today.

   ↓
5. GDPR Art. 28(3)(d)GDPR Art. 30 Live

   Sub-processor transparency

   A full, dated, transfer-basis-tagged sub-processor register is published on this page — see the sub-processor list above. Changes are announced at least 30 days in advance, with 14 days to object.

   ↓
6. GDPR Art. 5(2) Roadmap

   Independent verification recipe

   Once the first daily anchor lands (node 4 above), anyone will be able to verify it independently — no trust in Rakomi required. The recipe to reproduce and check the proof will be published alongside it, so the accountability claim becomes something you demonstrate for yourself rather than take on faith.

   To be explicit about today: no independent anchor has been produced yet, so there is nothing to verify and no verification recipe is published. This node flips to present tense together with node 4, and not before.

• Near term — independent anchoring flips from roadmap to present tense once the first public daily anchor lands. This is gated on agent traffic (weeks away, not a fixed date), not on further engineering.
• 2027 — the eIDAS2 / EUDI qualified-ledger upgrade (a regulated qualified-ledger / EBSI path) is under evaluation. Only that upgrade would earn a statutory legal presumption; today's free public anchoring deliberately does not claim one.

Shared Responsibility Model

Authentication security is a partnership. Here's where Rakomi's responsibility ends and yours begins.

Rakomi acts as a data processor; the sub-processors below support the services your provider — the controller — offers you. Processors marked conditional only receive data when your provider has enabled the related feature (for example, a provider with no billing never reaches the payment processor).

Copies of the Standard Contractual Clauses and other transfer safeguards are available on request — contact our data-protection team at dpo@rakomi.com.

Transfer bases last reviewed: 2026-06-27.

Changes to this list are announced at least 30 days in advance via our status page and changelog. Controllers have 14 days from notification to object.

2026-06-27 — Correction to this register (no change of sub-processors). This published list was incomplete. Cloudflare, Microsoft, Apple, Google, Twilio, Stripe and Fakturownia were already engaged sub-processors, already covered by our Data Processing Agreement; they were missing from this page and are now listed, together with a per-processor transfer-basis column. No sub-processor was newly engaged — this is a correction to the published list, not a notification under our 14-day advance-notice commitment.

2026-07-13 — BetterStack, Inc. removed from this register (reclassification, not a change of supplier). BetterStack remains our uptime-monitoring provider. It was removed because it processes no personal data of your end-users and is therefore not an Art. 28 sub-processor; it is managed under our supplier-security controls instead. Our engagement with the vendor is unchanged.

2026-08-01 — Correction to the advance-notice period stated on this page. This page previously stated that changes to this register are announced at least 14 days in advance, including in the notice dated 27 June 2026 above. That understated what we grant: our Data Processing Agreement gives 30 days’ advance notice of a sub-processor change, and a further 14 days to object. The two windows had been collapsed into one. The 30-day term has been in force since the first version of the agreement and did not change; only this page was wrong, and it was wrong in the direction of promising less than we owe. No notification was ever given on the shorter period, and no sub-processor arrangement changed. The earlier notice is left as it was published; this entry is the correction.

Live uptime metrics and incident history are published on our status page from Day 1 of operation.

Security & Privacy Contact

• Security vulnerabilities: /security (responsible disclosure programme)
• Privacy & GDPR: dpo@rakomi.com
• DPA requests: dpo@rakomi.com