Answers to what you're wondering.

In the EU/EEA — primarily in Germany, secondarily in Norway. No US hyperscalers.

All data is stored within the EU/EEA. The primary region is Germany, the secondary region is Norway. We don't use any US hyperscalers for the platform itself, and the architecture is Schrems II-compatible from day one. This means data doesn't cross jurisdictions — neither to the US nor any other country outside the EU/EEA. For you as a customer, it means GoRabbit is a platform you can use without worrying about cross-border data transfers or uncertainty about legal regimes inconsistent with European law.

Yes — GDPR is built in from the ground up. DPA template available for all SMB customers.

Yes — GDPR compliance is built in from the ground up, not added later. We follow the core principles: data minimisation (we only collect what we need), purpose limitation (data used for marketing isn't used for other purposes), storage limitation (clear rules on retention), rights response (access, rectification and erasure handled within 30 days), and data processing agreement (DPA) available for all SMB customers. You own your own data; we process it on your behalf. More details in our privacy policy and DPA template.

You own customer data, campaigns and results. We own the engine and the infrastructure.

You own your contact database, lead data and customer segments, the campaigns and images you've generated, performance results and KPIs, and your tone and brand settings. The platform owns the engine itself (code, models, orchestration), the reusable engine structures, telemetry and diagnostics for operations, and aggregated patterns that are anonymised and cannot be traced back to individual customers. The line is simple: everything that's yours, and anything identifying your customers, belongs to you. The platform's general learning and infrastructure belong to us.

No — no customer data is trained into third-party models. Zero Data Retention where available.

No. No customer data is used to train third-party AI models. We use OpenAI and Anthropic as API providers for text and image generation, and use the Zero Data Retention flag where available. Personally identifiable information is masked before outbound calls to the AI providers. WarmUp — our internal learning mechanism that makes the platform smarter over time — sits on top of the models, not inside them. This means we can switch AI provider without losing the learning, and the learning never goes to other customers or external services.

AES-256 at rest, TLS 1.3 in transit, RBAC per module, MFA on all admins, audit trail for 12+ months.

We use AES-256 encryption for data at rest and TLS 1.3 for data in transit. Encryption keys are managed via HSM (Hardware Security Module) with the cloud provider and rotated quarterly. Access control is role-based (RBAC) per module, so a user can for example have read access to segments without access to payment data. Multi-factor authentication is required for all administrators, and enterprise customers can connect their own Single Sign-On (SAML/OIDC). Every single action is logged — who did what, when, from where, against which data — and the logs are immutable and retained for at least 12 months.

Each customer has its own logical database instance — no cross-references, no shared schema.

Each customer has its own logical database instance. There are no cross-references and no "shared schema" pattern, and customer tenants are partitioned so a large customer's load doesn't affect others. Cross-tenant leakage is not a risk scenario in our architecture — it isn't technically possible under normal operation. Backup and restore happen per tenant without downtime for others. The platform is multi-tenant by design from day one, not retrofitted, so the isolation is a structural property, not a rule requiring compliance.

Yes — standard DPA available for all SMB customers. Request via gorabbit@nicelife.io.

Yes. We have a standard data processing agreement available to all SMB customers, and it accurately reflects the GDPR roles: you are the data controller for your customer data, we are the processor. The DPA covers purpose, duration, security measures, sub-processors, rights response, breach notification and termination of processing. For larger organisations with specific requirements we can discuss adaptations to the template. Request the DPA template via gorabbit@nicelife.io or ask during onboarding.

RTO < 4 hours primary, < 24 hours secondary. Feature flags, blue/green deploys, runbooks and postmortems.

We have structured logging, metrics and tracing across all modules and engines, and alert automatically on critical failures. Incident handling has clear runbooks for all critical systems, with a target of under 4 hours for primary recovery (RTO) and under 24 hours for secondary recovery. We have feature flags that allow new functionality to be turned off instantly if anything misbehaves, and blue/green deploys mean rollback takes seconds, not minutes. Postmortems from larger incidents are published to customers. Failover between regions is activated as the customer base demands it — the readiness is in place.

Automated vulnerability scanning ongoing. External pen test from 2026. Reports shared under NDA.

Yes. We have automated dependency scanning on all code, and critical CVEs are patched within 24 hours. An annual external penetration test is planned from 2026. Pen-test reports become available after the first test has been completed, and can be shared with enterprise customers under NDA. We also follow standard principles for secure development — code review, tests on every commit, and "launches are boring" as a philosophy: rollouts are boring because they're predictable, not because we aren't doing anything new.