Client data stays in your environment
Default deployment is on-prem or inside your VPC. We design pipelines so client data does not need to leave your infrastructure to be processed.
Security & trust
How we handle your data.
Financial data is regulated and sensitive by default. This page is exactly how we treat it, deploy around it, and stay accountable to your compliance team, with no claims we can't back up in your due-diligence questionnaire.
Data handling
The defaults, not the exceptions.
No training on client data
We don't use client data to train or fine-tune models for other clients or for Rexto's own products. Any fine-tuning is scoped, contracted, and stays inside your environment.
Least-privilege access
Engineers get access to the systems and data required for their part of the engagement, for the duration of the engagement, and it is revoked at handover.
Encrypted in transit and at rest
Any data that does move between systems is encrypted end-to-end; we follow your existing key-management and secrets-handling standards rather than introducing our own.
Compliance alignment
Where we stand today, plainly.
We're not a certified auditor, and we don't claim a report we haven't undergone. Where a client's due-diligence process requires a specific certification, we say so upfront and work out what's actually needed for that engagement, rather than imply coverage we don't have.
Our practices are built to align with:
GDPR
Data minimization, a clear lawful basis for anything we touch, and deletion paths that actually work rather than a clause in a policy.
EU AI Act
Any credit, insurance-pricing or fraud-adjacent system is treated as high-risk from the outset. Documentation, human oversight and a testable evaluation suite are part of the build, not a retrofit.
DORA
AI systems are treated the way you're required to treat any ICT third party: incident-reporting paths, resilience testing and clear lines of accountability designed into the engagement, not promised in a proposal.
We're building toward formal certification as the team and client base grow. Until then, we'd rather describe exactly what we do and don't have than claim something we can't back up when your compliance team asks.
Engagement security
How this looks in a live engagement.
Access control
Scoped, time-boxed credentials per engagement; revoked at handover, not left dangling.
NDAs as standard
Signed before any client data or system access changes hands, not after a deal is agreed.
Encrypted communications
Client channels and file transfer go through encrypted tooling; we don't default to email attachments for anything sensitive.
EU data residency options
For clients who need it, infrastructure and any Rexto-side processing can be pinned to EU regions.
FAQ
Do you train models on our data?
No. We don't use client data to train or fine-tune models for other clients or for our own products. Any fine-tuning done as part of an engagement is scoped to that engagement and stays inside your environment.
Can this run entirely on-prem or in our own cloud?
Yes. That is the default architecture for regulated clients, not an add-on. We design around your infrastructure rather than routing data through ours.
Are you SOC 2 certified?
Not yet. We build with the relevant controls in mind from day one and will say plainly where a formal certification is and isn't in place for a given engagement, rather than imply one we don't hold.
How do you handle the EU AI Act for high-risk use cases?
We treat credit, insurance-pricing and fraud-detection systems as high-risk by default: documentation, human oversight points and an evaluation suite are built in from the pilot stage, not added before a compliance review.
What happens to our data and access when the engagement ends?
Access is revoked at handover. Any data used to build or test the system that lives outside your own environment is deleted on an agreed schedule, not retained indefinitely.