This document is a working draft. It describes how Rikoo behaves, accurately, but the entity names, addresses and jurisdictions are placeholders and it has not been reviewed by counsel. Complete it in the Studio, have it reviewed, and remove this paragraph before launch.
Last updated: [date]. Between you (the controller) and [legal entity] (the processor).
When these terms apply, and when they do not
Self-hosting Rikoo does not make us a processor. The software runs on your infrastructure, we receive nothing, and you are the controller of everything that passes through it. There is no processing for us to describe and no transfer to assess.
These terms apply only in the situations below.
- A support engagement where you deliberately share logs, exports or a reproduction containing personal data.
- A managed offering, once one exists. It does not today.
- Correspondence you send us, which is covered by the privacy notice rather than by these terms.
Subject matter and duration
We process personal data only to provide the service you asked for, for as long as it takes, and we delete or return it at the end. Duration: [the term of the engagement].
Nature and purpose
Diagnosing a defect, reproducing a failure, or operating the service in the case of a managed offering. We do not use your data to train models, to improve our product beyond the fix at hand, or for any purpose of our own.
Categories of data and of people
Whatever your agents handle: this may include the content of conversations, the documents in your knowledge collections, and identifiers of your end users. Categories of people: your users, your employees, and anyone whose data your agents process. You decide what reaches us, and the practical advice is to send us as little of it as you can.
Our obligations
- We process personal data only on your documented instructions.
- Everyone we allow near it is bound by confidentiality.
- We apply appropriate technical and organisational measures, described below.
- We engage no sub-processor without telling you first and giving you the chance to object.
- We help you answer requests from people exercising their rights, and help you with impact assessments and breach notifications.
- We tell you without undue delay if we become aware of a personal data breach affecting your data.
- At the end, we delete or return everything, unless the law requires us to keep it.
- We make available what you need to demonstrate compliance, and allow audits.
Security measures
The measures below apply to the product itself and therefore to any environment we operate on your behalf.
- Credentials sealed under an envelope key, never readable again, with every access audited.
- Encryption in transit; encryption at rest as provided by [hosting provider].
- Tenant isolation enforced at the data-access layer rather than by application filtering.
- One sandbox per agent run, destroyed with the run.
- An anti-SSRF guard on every outbound call.
- An append-only audit log of administrative actions.
- Access to any environment we operate limited to named individuals and reviewed [frequency].
Sub-processors
Current sub-processors: [hosting provider, location], [email provider, location], PostHog, European Union, used for analytics on this website only and never for anything running on your infrastructure. The list is kept current on this page, and we give [notice period] before adding one.
International transfers
Where personal data leaves [region], the transfer relies on [transfer mechanism] together with the supplementary measures the case requires. If you self-host, this section is moot: nothing leaves your infrastructure because of us.
Model providers are yours, not ours
When your agent calls a model provider, that call is made from your infrastructure under your own contract with that provider. They are your sub-processor, not ours, and their terms decide whether they retain or train on what you send. Choosing a provider is part of your compliance posture, and Rikoo is deliberately built so that choice stays open. A model you host yourself leaves no third party in the picture at all.