Your data is your office's capital. This page summarizes how the platform protects it, without jargon. The legal perspective lives in the legal section, your office's duties in GDPR for agents.
Database and hosting run in Frankfurt (EU). No transfer to countries outside the EU takes place unless you connect services outside the EU yourself (for example your own AI keys via BYOK).
Transit and storage are encrypted. Especially sensitive content such as the credentials vault is additionally protected at the application level; the highest tier (zero knowledge) cannot be read even by the operator.
Workspace isolation
Every data row belongs to exactly one workspace and is isolated at the database level. The protection does not depend on the interface; it sits one layer deeper.
Double checking
Rights are checked in the interface AND on the server. What your role may not do stays impossible even with technical tricks.
Upload inspection
Uploaded files are checked for their real content (not just the file name); executables and unsafe graphics are rejected.
Security-relevant actions land in the workspace's activity log (Settings > Activity): who did what and when, for example revealing a credential in plain text or creating a share. The content of secrets never appears in the log, only the event.
Deleted files go to the trash first (30 days by default, configurable) and are then removed permanently.
Tools handling personal data have documented periods; for example the WhatsApp bot deletes technical raw data after 14 days, and website inquiries are removed 12 months after being resolved.
Real deletion is always a separate, explicit step; uninstalling a tool deletes no data.
Operator access is limited to what is necessary and contractually governed (see the DPA). Zero-knowledge content in the vault is technically unreadable for the operator.
What happens during an outage?
You can see the platform's live status any time on the status page (status.reosa.de). During incidents the platform communicates transparently; AI jobs that fail technically are refunded.
Can I export all data?
Export paths exist where the data lives (for example CSV exports in the tools); a complete workspace export as a package is in the works and listed as an outlook in the storage settings.
