Built for your GDPR review.
No marketing fluff - clear regions, documented processes. This page is written for CIOs and data protection officers.
1. GDPR compliance
Rentarion meets Art. 13/14 (notice), Art. 15 (access), Art. 17 (erasure) and Art. 20 (portability) of the GDPR. Every tenant can export its data as JSON or request full deletion.
2. Sub-processors
Database, file storage, OCR, AI field extraction, email delivery and backups all run in EU data centres; the encrypted off-site backups are held in Germany. Data processing agreements under Art. 28 GDPR are in place with all processors, or will be concluded before production use. For AI field extraction: no training on your data - contractually assured within the EU Data Boundary.
Full list of processors in the privacy policy3. Data minimisation & encryption
Encryption at rest and in transit throughout. Password hashing with bcrypt (12 rounds). No tracking tools without consent. Session cookies httpOnly, SameSite=Lax.
4. Multi-tenant isolation
Strict tenant separation at the application level: every database query is tenant-bound. In addition, PostgreSQL Row Level Security acts as a default-deny safeguard at the database level. Regular tenant-isolation audits - most recently without a single exploitable finding.
5. Audit log & four-eyes
Every field change, every approval step, every upload, every export - with user ID, timestamp, before/after. Critical fields require two-person approval.
6. Anti-hallucination
The AI provides citations, but we do not trust blindly: every citation is checked via exact substring match (after whitespace and case normalisation) against the OCR text. No fuzzy matching. Failed verification → citation discarded.
7. Legal early warning
Rentarion flags points that can become legally critical - notice periods (§573c/§580a BGB), stepped and index rent agreed side by side (§557a(3) BGB), or heating cost allocation outside §§7/8 of the Heating Costs Regulation. The alerts follow fixed, traceable rules - no AI, no legal advice - and do not replace a legal review: assessment and decision remain yours. Details on the Features page under #legal-engine.
8. Role permissions
Five roles with fine-grained rights: admin (full tenant control), portfolio manager (day-to-day operations), approver (four-eyes approvals), viewer (read-only) - plus platform administration. Individual permission flags per user, role changes are audit-tracked.
9. Password security & auth
Self-service password reset with 1-hour token. Anti-enumeration (same response regardless of whether the email exists). New passwords are checked against known data breaches (k-anonymity - the password never leaves the browser). Invite-only onboarding - no public registration.
10. Backups & recovery
Daily encrypted off-site backups of database and files in Nuremberg, Germany - deliberately with a different provider than the primary storage (3-2-1 principle). Restorability is verified automatically every week.
Questions from your IT or DPO?
We provide DPA templates, TOMs and an architecture overview on request.