Built for your GDPR review.
Clear locations, documented processes. Each section opens with the essentials in one sentence, followed by details for your IT team and data protection officer.
We're happy to demo on one of your own leases, under NDA if you like. A pilot with some of your leases can follow.
Data protection under GDPR
You can export your data yourself at any time, and we delete it completely on request.
Technical details
Rentarion meets Art. 13/14 (notice), Art. 15 (access), Art. 17 (erasure) and Art. 20 (portability) of the GDPR. Administrators export all of their company’s data themselves as a machine-readable file; full deletion is carried out by us on request.
Where your data is stored
Processing takes place exclusively in the EU, backups are stored in Germany, and no AI is trained on your data.
Technical details
Database, file storage, text recognition, AI extraction, email delivery and backups all run in EU data centres; the off-site backups are held in Germany. Data processing agreements under Art. 28 GDPR are in place with all processors. For AI extraction: no training on your data, contractually assured.
Encryption
Transmission and storage are encrypted.
Technical details
Encrypted transmission throughout, database and files stored encrypted. No tracking tools without consent.
Separation between customers
No customer can see another customer's data - protected at two levels.
Technical details
Strict tenant separation in the application, additionally secured at database level. Regular internal security reviews.
Traceability
Changes to lease data are logged with person and time, and critical fields are approved by a second person.
Technical details
Changes to lease fields, approvals, uploads and exports are logged with user, timestamp and before/after value. Critical fields require two-person approval.
AI and evidence
The AI suggests values and points to the passage in the lease; values that drive deadlines are approved by a person.
Technical details
The AI provides a citation for every value it reads, but we do not trust blindly: every citation is checked against the recognised text of the lease page. If it cannot be found there, it is discarded.
Early warnings
Fixed rules instead of AI, the assessment stays with you.
Technical details
Fixed, transparent rules based on German law flag points that can become legally critical, such as notice periods (§573c/§580a German Civil Code, BGB), stepped and index rent agreed together (§557a(3) BGB), or heating cost allocation outside §§7/8 of the German Heating Costs Ordinance. No AI, no legal advice, no substitute for a legal review: the assessment and the decision remain yours.
Roles and permissions
Everyone sees and does only what their role allows.
Technical details
Four roles with graded rights: administration (full control within your company), case handling (day-to-day operations), approval (four-eyes principle), read-only, plus our platform administration. Individual rights per person, role changes are logged.
Sign-in
Two-factor sign-in for every person, passkeys instead of typing codes, a notice when someone signs in from a new device.
Technical details
Every sign-in requires a second factor from an authenticator app in addition to the password, mandatory for all users. If you prefer, confirm with a passkey instead (Face ID, Touch ID, Windows Hello or a security key, open FIDO2/WebAuthn standard). Your own devices can be remembered for 30 days; if someone signs in from an unknown device, a notification email goes to the account immediately. Lost your phone: recovery codes or a reset by an administrator, logged. As before: invited people only, no public registration, new passwords checked against known data breaches, reset via a time-limited link.
Backups
Backed up daily, with a second provider in Germany.
Technical details
Daily off-site backups of database and files in Nuremberg, Germany - deliberately with a different provider than the primary storage. We check automatically every week that the backups are readable.
Questions from your IT or DPO?
We compile documents for your data protection review on request, such as technical and organisational measures (TOMs) and an architecture overview.