GoRabbit – Operating Model & Governance

1. What is meant by AaaS – Architecture as a Service?

GoRabbit is built as Architecture as a Service (AaaS). This means customers do not just buy access to a tool, but to a whole architecture: processes, integrations, monitoring and operation – delivered as one service.

Instead of assembling individual components themselves (publishing tools, image tools, AI services, automation etc.), GoRabbit delivers a complete framework where AI, automation and insight work seamlessly together.

Our customers subscribe to services instead of buying individual tools. We provide infrastructure, security, maintenance, integrations and ongoing improvement – while the customer experiences that GoRabbit “just works”. Our model provides high availability, scalability and predictable costs.

2. Why we chose AaaS as the operating model

We want to give customers the freedom to build their own marketing on their own terms – with the best of several worlds. A “Best of Breed” strategy lets customers choose the tools, channels and technologies that suit them best – while GoRabbit handles everything in between: integration, process, security and control.

This creates flexibility, innovation and lower costs. At the same time, security is strengthened through cooperation with providers who keep up with laws, regulatory requirements and technological development.

3. GoRabbit's purpose

GoRabbit aims to be the automated engine of marketing – the glue between creative ideas, technological solutions and the customer's growth ambitions. We help businesses transform and scale their marketing through fully automated processes, combined with human control and insight. And of course – we aim to operate profitably by delivering value, quality and trust.

4. Our delivery model

GoRabbit handles all elements of the service:

• Availability, security and continuity of the service
• Monitoring and handling of operational deviations
• Software and license management
• User and access management
• Alerts and dialogue via agreed support channels

5. Governance documents and structure

To ensure verifiability, trust and quality, GoRabbit follows a set of documented governance and control artifacts. These form the basis for audit, customer dialogue and continuous improvement.

Status	Artifact	Purpose / Description
In place	Business Model	Shows how GoRabbit creates value, target group, services, operation, finance and risk analysis.
In place	Revenue Model	Subscription per customer, campaign or volume (e.g. per output channel or month).
Planned	Service Level Agreement	Describes expected service level, availability, performance, KPIs and reporting on service delivery.
Planned	Support and ServiceDesk	Operational processes, response levels and customer support channels.
In place	Information Security Guidelines	Guidelines and routines for information security, inspired by recognised frameworks (e.g. ISO 27001 and CIS Controls).
In place	Data Governance Policy	Describes principles for handling data, quality, security and privacy.
In place	Service Architecture	Describes how GoRabbit's core components and integrations interact to deliver the service.
In place	Backup / Disaster Recovery	Plans for recovery of data within one day and continuous redundancy.
Planned	Business Continuity Plan (BCP)	Plans for maintaining operations during major interruptions or incidents.
In place	Data Processing Agreement (DPA)	Agreement framework governing data processing, roles and responsibilities between controller and processor.
Planned	Vendor Risk Assessment	Regular assessment of third-party providers and sub-processors.
Planned	Exit Plan	Describes how customers can wind down the cooperation safely and in a structured way.

6. Technological foundation

GoRabbit is built as a set of services, each with its own processes, security level and backup strategy. GoRabbitEngine runs campaigns, scheduling and content production. GoRabbitPublisher handles publishing to the channels. GoRabbitVerifier checks email addresses before any send-out. The customer interface at gorabbit.no gives the customer one place for overview, approval and control.

7. Security, risk and audit

• All modules are assessed regularly with regard to security and risk.
• Data processing takes place within the EEA, with encryption and access control. Named sub-processors outside the EEA (such as Stripe, Twilio, OpenAI and Anthropic) process data under the EU Commission Standard Contractual Clauses, as set out in the Data Processing Agreement.
• Customers can request access to audit and risk assessments as needed.

8. Continuity and transparency

Our model should be as predictable for customers as for partners. All service components are documented, with a clear division of roles and responsibilities. The GoRabbit platform is developed continuously, but operational stability and backward compatibility are always prioritised.