Is ROOTKey certified, where is my data, and what does the SLA cover?

Q: Are you SOC 2 certified?

The SOC 2 Type 2 audit is in progress. ISO 27001 is also in progress. Contact sales for the current security posture document.

Q: Do you store our data?

On the SaaS platform, ROOTKey hosts your data in the EU. With a private cloud or on-premise deployment, your data stays wherever you decide. For recovery, encrypted snapshots are stored according to your configuration.

Q: Does using ROOTKey constitute data processing under GDPR?

It depends on the deployment model. On the SaaS platform, ROOTKey hosts the protected data in the EU and acts as a processor under a Data Processing Agreement. With a custom deployment where the data stays in your infrastructure, ROOTKey handles only fingerprints and metadata, never the files. A fingerprint is one-way and does not contain the data, but a fingerprint of personal data can still count as pseudonymised personal data under the GDPR, so cover ROOTKey's role in your processing records and the Data Processing Agreement. We recommend that your legal team confirms the roles that apply to your case.

SOC 2 Type 2 · ISO 27001: in progressSaaS hosted in the EUDPA available on request

Short answer

Not yet: the SOC 2 Type 2 audit and ISO 27001 are both in progress. On the SaaS platform your data is hosted in the EU; with a private cloud or on-premise deployment it stays wherever you decide. Data is encrypted with AES-256 at rest and TLS 1.3 in transit. The 99.9% availability SLA is contractual on the Enterprise tiers and a target on the platform plans; Enterprise contracts can add custom SLAs.

SOC 2 Type 2: In progressaudit under way
ISO 27001: In progressAlignment under way · certification in progress
Uptime SLA: 99.9%Contractual on Enterprise, a target on platform plans
Recovery window: < 4hContractual on Enterprise, a target on platform plans

Certifications: where they stand

Neither audit is complete yet. NIS2 and DORA are EU legal obligations rather than certifications; ROOTKey is aligned with both.

Framework	Status	Detail
SOC 2 Type 2	In progress	Audit under way
ISO 27001	In progress	Alignment under way · certification in progress
NIS2	Aligned	Art. 21 - Risk management · Art. 23 - Incident reporting
DORA	Aligned	Art. 9 - ICT security · Art. 17 - Incident management

Evidence for NIS2 (Art. 21, 23), DORA (Art. 9, 17) and GDPR (Art. 32): a cryptographic audit trail, integrity reports and evidence packs.

Need the current security posture document? Talk to our team.

Data sovereignty

Is my data stored in Europe?

On the SaaS platform, yes: your data is hosted in the EU, in line with GDPR. With Enterprise custom deployments (private cloud or on-premise), it stays wherever you decide.

Model	Data location
SaaS	Managed by ROOTKey · hosted in the EU
Private cloud	Your cloud provider · your account
On-premise	Entirely within your perimeter
Hybrid	On-premise for data · separate SaaS dashboards

Recovery module: encrypted snapshots are stored according to your configuration.

How each model is set up and how long it takes: Deployment.

Security posture

At rest: AES-256 encryption at rest
In transit: TLS 1.3 in transit
Isolation: Multi-tenant with logical isolation · on-premise option for full physical isolation
Snapshots: Immutable snapshots are taken continuously: encrypted, fingerprinted and stored in geographically separated locations.

Availability, recovery and the SLA

Uptime SLA: 99.9% · Contractual SLA on the Enterprise tiers. Platform plans: availability target.
Recovery window: < 4h · Full data recovery after an incident. Contractual on the Enterprise tiers. Platform plans: recovery target.
Custom SLAs: Tailored SLAs for availability, latency, recovery objectives and escalation paths. Available on the Sovereign tier.
24/7 Incident Hotline: Included on every Enterprise tier.
Dedicated Technical Account Manager: Infrastructure and Sovereign tiers.

What each tier includes: Enterprise pricing.

Procurement & Legal

NDA	Available on request - contact sales
MSA	Standard + custom available
DPA	Available on request
Subprocessor list	Available on request
Liability	Negotiable at the Sovereign tier
Vendor lock-in	None - no proprietary formats, export your audit data at any time

Frequently asked questions

Are you SOC 2 certified?

The SOC 2 Type 2 audit is in progress. ISO 27001 is also in progress. Contact sales for the current security posture document.

Do you store our data?

On the SaaS platform, ROOTKey hosts your data in the EU. With a private cloud or on-premise deployment, your data stays wherever you decide. For recovery, encrypted snapshots are stored according to your configuration.

Does using ROOTKey constitute data processing under GDPR?

It depends on the deployment model. On the SaaS platform, ROOTKey hosts the protected data in the EU and acts as a processor under a Data Processing Agreement. With a custom deployment where the data stays in your infrastructure, ROOTKey handles only fingerprints and metadata, never the files. A fingerprint is one-way and does not contain the data, but a fingerprint of personal data can still count as pseudonymised personal data under the GDPR, so cover ROOTKey's role in your processing records and the Data Processing Agreement. We recommend that your legal team confirms the roles that apply to your case.