Trust Center: security, data protection and operations: documented openly.
Sovereignty is only credible if it survives scrutiny. Here your audit team, data protection and purchasing find how RAGSuite is built, where your data lives and which documents exist: separately for the Cloud in Germany and for running it yourself.
Report a vulnerability: security@ragsuite.de
Cloud in Germany or self-hosted: who is responsible for what?
| Topic | RAGSuite Engine | RAGSuite self-hosted |
|---|---|---|
| Operations, updates, backups | RAGSuite | your team (or a partner) |
| Data centre | [Rechenzentrum], Germany | your servers or rented servers |
| GDPR role | RAGSuite is processor (DPA) | no RAGSuite processor |
| Sub-processors | list in the Trust Center, incl. model providers | only the model providers you choose |
| Language models | per project, location shown | local too, air-gapped too |
| Audit log | full with export | Community 15 days · Enterprise full |
The Cloud in Germany: data centre, contracts, sub-processors.
In RAGSuite Engine we run the platform for you in a data centre in Germany. You sign a data processing agreement with us; we provide the technical and organisational measures and the list of sub-processors. Model providers are on that list with their location.
Your data trains no model. You set deletion periods and storage; when you cancel, you export your content and we delete it after the agreed period.
Self-hosted: your data does not leave your environment.
A self-contained stack
FastAPI services, PostgreSQL, Redis and a vector store: natively or with Docker on infrastructure you control.
No outbound dependency
No phone-home. External calls only go to model providers you configure yourself, or none at all, with a local model.
Your encryption, your backups
Data sits in your databases, under your key management and your backup concept.
Keys with you
Model provider API keys and the offline Enterprise licence stay with you.
Accountable and easy to reach.
Reporting vulnerabilities
Write to security@ragsuite.de; our security.txt (RFC 9116) lists the contact. We acknowledge reports and work them to resolution.
How to report →Regular security reviews
Code and platform are reviewed regularly; we share results with audit teams in the Trust Center process.
Provider in Germany
RAGSuite is a brand of NITSAN GmbH (Dresden local court, HRB 48599). Support in German and English.
Documents on request
Architecture notes, GDPR data flow, TOMs, record template, versioning and update policy.
Updates, backups and recovery.
RAGSuite follows semantic versioning with a clear rule for changes that need adjustments. Moving from Community to Enterprise happens in place via a licence key. PostgreSQL, Redis and the vector store have documented backup and recovery procedures, in the cloud we run them, self-hosted your team does.
Cyber Resilience Act: what applies to RAGSuite.
The Cyber Resilience Act (Regulation (EU) 2024/2847) governs the security of software placed on the EU market. Because RAGSuite is also offered for self-hosting, it is in scope; NITSAN GmbH is the manufacturer. Since 11 September 2026 the reporting duties for actively exploited vulnerabilities and severe incidents apply; the remaining duties from 11 December 2027.
We are working towards the essential requirements and only list a capability here once it has shipped. We do not claim CRA conformity or CE marking today.
Questions for the Trust Center.
Where does our data live in the Cloud in Germany?
In a data centre in Germany, run by RAGSuite. Documents, search index and history live there. Only the question and matching passages go to the chosen language model; you see the model’s provider and location when you choose it and on the list of sub-processors.
Is there a DPA?
Yes. In the Cloud in Germany you sign a data processing agreement with us, including TOMs and the list of sub-processors. If you run RAGSuite yourself, we process none of your data; a DPA with us is then only needed if we get access to data during support.
How do we report a vulnerability?
Write to security@ragsuite.de. Our security.txt under RFC 9116 lists the contact, and the vulnerability reporting page describes the process. We confirm receipt, assess the report and keep you informed until it is fixed. Please publish details only after agreeing with us.
Which documents do we get for an assessment?
Architecture notes, the GDPR data flow, technical and organisational measures, a template for the record of processing, the versioning and update policy, and for the Cloud in Germany the DPA and sub-processors. Request them via the contact form; we usually send them within one working day.
Are there service level objectives?
Yes. There are defined targets for response time and availability; we offer SLA tiers with Enterprise support and for the Cloud in Germany. We share the specific figures with your audit team in the Trust Center process, together with the other documents on operations and security.
Your audit team has questions? We have documents.
Request the documents for your assessment or go through the questions with us in a call.