We use a few cookies to keep you signed in and the site secure. With your okay, we also use some to spot errors and see how the site is used. We don't run ads. You can change this anytime, and our cookie policy has the details.
Trust center
Certifications, controls, subprocessors and audit reports, published here rather than behind a vendor portal. The confidential documents are one request away.
Certifications
Independent auditors test our controls on a schedule.
Security, availability and confidentiality controls, tested across a full audit window rather than at a single moment.
Under NDA
Information security management: risk assessment, supplier management, access control, incident response. Certified against the 2022 revision.
Under NDA
How we build, evaluate and monitor the AI in Reos, including impact assessment and human oversight of AI output.
Under NDA
A DPA with Standard Contractual Clauses, a record of processing activities, a transfer impact assessment, and data subject requests answered on time.
DPA on request
Confidential documents
The confidential documents are shared under a short mutual NDA. Request access with a Reos account, sign in your browser, and they open at once. No sales call.
Access lasts 90 days and is renewable.
An account is all we link the NDA to. No plan or payment required.
Report
Certificate
Certificate
Penetration test
Controls
The controls behind the certifications.
Subprocessors
Every third party that processes personal data for Reos customers, what it does and where. We notify customers 30 days before this list changes.
Version 3 · Effective 29 September 2026 · 20 subprocessors
Where the product runs and where customer data rests.
A subprocessor is a third party that processes personal data on behalf of Reos in order to deliver the service. Every subprocessor on this list is bound by a data processing agreement, is assessed before onboarding, and is reviewed at least annually as part of our ISO 27001 supplier management process.
For transfers out of the EEA, the UK or Switzerland to a country without an adequacy decision, we rely on the EU Commission's Standard Contractual Clauses, supplemented by the EU-US Data Privacy Framework where the recipient is certified. Our Transfer Impact Assessment covers these transfers and is re-evaluated at least every six months.
Customer research data at rest - database records, uploaded files and vector indices - is stored in the region the customer selects: the EU (Frankfurt) by default, or the United States. Account, authentication and organisation registry data is always stored in the EU (Frankfurt).
AI processing is transient and may occur outside the selected region, as noted per provider above. No research content is retained by an inference provider after the request completes, and no provider on this list is permitted to train models on it.
We notify customers at least 30 days before a new subprocessor starts processing their personal data, so there is time to object. Notice goes to the email address on the account and appears on this page, with the version and effective date at the top updated in the same change.
If you would like to receive subprocessor change notices at a dedicated address - a security or privacy alias rather than the billing contact - tell us and we will add it.
Questions
Talk to us or read the privacy policy.
