Encryption
Data is encrypted in transit (TLS 1.2+) and at rest (AES-256).
Security
Your cloud. Your code.
Deployed in your cloud, under your controls.
Everything we build runs on your own infrastructure. Your data lives inside your own cloud, in a region you choose, and we don't touch it without your written consent.
Bookings are handled by Cal.com.
The basics
Security, stated plainly.
Audit trail
Every output is logged against the input and prompt that generated it, so every result can be checked against its source. This is reproducibility, not an explanation of the model's reasoning.
Written consent
We don't touch your data without your written consent.
No lock-in
If we stop working together, the code and infrastructure remain yours.
Where your data lives
Your own cloud
Your data lives inside your own cloud, in a region you choose.
The judgment layer
When the input is messy — contracts, emails, PDFs — the models that read it are deployed on your infrastructure, never routed through ours.
Workflows on your infrastructure
The recurring workflows we automate run as background processes on your infrastructure.
Yours to keep
The code we deliver is documented and yours to keep.
Documentation thorough enough for your own team to take over without us.
We deploy, test and hand over the code and the documentation.
Everything runs on your environment, with no dependency on Rensole and no licensing arrangement to unwind.
In your hands
You decide where your data lives and who can access it.
Your keys
Where required, your organization holds the encryption keys, and we have no access to the underlying data.
Your users
Access is limited to the users you authorise.
Your team
We train your team to run it.
European sovereignty
Who can reach your data, and under which law
Where data is stored and processed, and which company runs the service, decide which laws can reach it.
The rules
GDPRRegulation (EU) 2016/679 · applies since 25 May 2018
Personal data can leave the EU only on set terms, such as a Commission adequacy decision or standard contractual clauses. Transfers to US companies on the Data Privacy Framework list can rely on a 2023 adequacy decision. The EU General Court dismissed a challenge to it in September 2025; an appeal to the Court of Justice, lodged in October 2025, was still pending on 24 October 2026. A court order from outside the EU does not, on its own, make a transfer lawful.
NIS2Directive (EU) 2022/2555 · national laws since October 2024
As a rule, it covers medium-sized and large organizations of the types listed in 18 sectors (in manufacturing, only six listed activities), plus some smaller ones. National laws require each to take supply-chain security measures, including for its relationships with direct suppliers and service providers. For a significant incident: an early warning within 24 hours of becoming aware of it, an incident notification within 72 hours, and a final report within a month of that notification. Portugal's decree-law dates from 4 December 2025; France's bill was still before Parliament on 24 October 2026.
DORARegulation (EU) 2022/2554 · applies since 17 January 2025
It covers EU financial entities, such as banks, payment institutions and investment firms. They stay fully responsible for compliance when they use tech providers. Their contracts must name the countries or regions where services are provided and data is processed and stored. For ICT services that support critical or important functions, they need exit strategies.
AI ActRegulation (EU) 2024/1689 · in force since 1 August 2024
It applies in stages: bans on certain practices since February 2025, rules for general-purpose AI models since August 2025, most transparency duties since August 2026. In July 2026 the EU pushed the core high-risk rules back to 2 December 2027, or 2 August 2028 for AI built into regulated products. It also covers providers outside the EU when they place AI on the EU market, or when the output of their AI is used in the EU.
Data ActRegulation (EU) 2023/2854 · applies since 12 September 2025
Cloud providers serving EU customers must let you switch to another provider or to your own systems. From 12 January 2027, as a rule, they may not charge for switching, including data egress fees for the switch. They must publish which jurisdiction their infrastructure is subject to. They must also guard against unlawful foreign government access to non-personal data held in the EU.
US CLOUD ActUS federal law · 2018
US law can require a provider under US jurisdiction to disclose data in its possession, custody or control, wherever that data is stored. What counts is jurisdiction over the provider, not where the data sits. EU law has a similar rule for criminal cases: since 18 August 2026, an authority in one EU country can order a provider offering services in the EU to produce or preserve electronic evidence, wherever the data is stored.
How we build
Your cloud, your region
Your data lives inside your own cloud, in a region you choose. Which laws can reach it also depends on which company runs that cloud.
Open-weight models, on your hardware
Open-weight models and local tools, set up on your own hardware, are an option alongside the frontier labs' tools.
This section is general information, not legal advice, checked on 24 October 2026. Proposed changes to the GDPR, NIS2, DORA and the Data Act were then still before the European Parliament. The terms of each engagement are set out in its written agreement.
FAQ
Questions worth asking.
How is our data encrypted?
Data is encrypted in transit (TLS 1.2+) and at rest (AES-256). Where required, we deploy in a configuration where your organization holds the encryption keys and we do not have access to the underlying data.
Where does our data live, and who can access it?
Inside your own cloud, in a region you choose. Access is limited to the users you authorise; we don't touch your data without your written consent.
How do you handle AI transparency and explainability?
Every output is logged against the input and prompt that generated it, providing a full audit trail. This is reproducibility, not an explanation of the model's internal reasoning — a distinction we think is important to be precise about. Every result can be reconstructed and checked against its source.
What happens to our systems if we stop working with you?
The code and infrastructure remain yours. Everything runs on your environment, is fully documented, and carries no dependency on Rensole — there is no lock-in, and no licensing arrangement to unwind.
What support do we get after the system goes live?
A fixed warranty window for bug fixes and tuning, plus documentation thorough enough for your own team to take over without us. Ongoing support beyond that is optional and priced separately.
Security questions?
Write to hello@rensole.com, or raise them on a discovery call.
Bookings are handled by Cal.com.