Trust Center

The line we draw

Rukkor operates two clearly separated domains. The Rukkor product is sovereign: EU-only, no tracking, content readable by no third party. Our commercial surface — the public website, marketing, and the Geometra product — uses ordinary business tools, including some US providers under EU safeguards. This page sets out both, honestly.

Rukkor product — the sovereign core

Hosting. All content inside the Rukkor product is hosted exclusively on servers operated by Hetzner Online GmbH, located in Germany within the European Union. Rukkor runs its own EU pipeline on this infrastructure. No United States–owned cloud provider hosts or has access to Rukkor product content.

No surveillance. Inside the Rukkor product we do not profile you, run behavioural tracking, use advertising or ad-tech technologies, sell or share your content, or use your content to train AI models for Rukkor or any third party. You are not the product. The analytics and advertising technologies described in the Website and marketing section of our Privacy Policy never operate on content inside the Rukkor product.

Content safety. Rukkor does not run proactive content scanning of your data. We handle illegal content, including child sexual abuse material, reactively — through reporting mechanisms, removal, and cooperation with the competent authorities. The EU legal framework for CSAM detection is currently in transition; we are following it and will implement any required, privacy-preserving measures (with a data protection impact assessment and consultation with the supervisory authority) once it is settled. Vault content remains end-to-end encrypted and outside any such measures.

Vault. Content you store in Vault is end-to-end encrypted and is not accessible to Rukkor, our infrastructure providers, or any third party. Because it is encrypted for your access only, Vault content cannot be shared with other users through the Services. Because we cannot read Vault content, you are responsible for retaining your Vault access credentials; if lost, the content cannot be recovered.

AI. AI-powered features in Rukkor are optional and operate only when you switch them on. When used, submitted content may be processed by Berget AI AB, a Swedish company that hosts open-weight models on EU/EEA infrastructure, to generate a response; all such processing takes place within the EU/EEA. We have a data processing agreement with Berget AI. Berget does not store your prompts or the AI outputs, and does not use your content to train AI models.

Encryption. Customer data is encrypted in transit and at rest using industry-standard protocols; Vault content is additionally end-to-end encrypted so that not even Rukkor can read it.

For the Rukkor product, content stays in the EU (Hetzner; Berget AI when AI is enabled) and other sub-processors see only metadata.

Commercial surface — website, marketing and Geometra

Our website and the Geometra product use analytics and advertising technologies (Google, Meta, LinkedIn) and run on a broader set of providers, some US-owned under EU Standard Contractual Clauses. These never touch Rukkor product content.

The full, current list of all sub-processors — grouped by service, with purpose, location and transfer mechanism — is published at www.rukkor.com/legal/sub-processors.

Security practices

• Role-based access control and MFA for administrative access.

• Production environments separated from internal systems, with monitoring for anomalous behaviour.

• Continuous logging and incident response; personal-data breaches notified within 72 hours.

• Regular internal security reviews, configuration and vulnerability assessment, and dependency scanning.

Certifications

We are pursuing ISO 27001 and SOC 2 as a parallel track, and rely in the meantime on the certifications of our EU infrastructure provider (Hetzner) and on GDPR-aligned operations. Progress is tracked against our internal security control checklist.

Documents

This Trust Center is our primary transparency mechanism and is consistent with our Privacy Policy and Data Processing Agreement. Contact: support@rukkor.com.