Rule is a cloud-based communication platform. The service runs over the internet and requires no installation. It is designed with security, resilience and high availability in mind.

This article explains how Rule handles customer data. For contractual commitments, please refer to our Data Processing Agreement (DPA), which takes precedence over this article in the event of any discrepancies.

Rule stores and processes data on behalf of its customers. The customer owns the data. Under the General Data Protection Regulation (GDPR), Rule acts as a data processor and processes customer data only in accordance with the customer's documented instructions.

Customer data is stored and processed in the AWS European Sovereign Cloud, in the eusc-de-east-1 region in Brandenburg, Germany. The service is distributed across both Availability Zones within the region.

The AWS European Sovereign Cloud is operated by Amazon Data Services European Sovereign Cloud GmbH, a company established in Germany. Its infrastructure, personnel and operational control are located within the EU, and the cloud is physically and logically separated from other AWS regions.

Optional AI Features

Rule's AI and analytics features, such as segmentation and predictions, run on Databricks in the AWS Ireland region, within the EU. The AI models used process data within the European Economic Area (EEA), Switzerland and the United Kingdom.

These features are enabled by default, but you can opt out at any time. If you do, your data will be deleted from Databricks.

Please note two things regarding access:

Rule complies with applicable laws and regulations, including the General Data Protection Regulation (GDPR).

All employees receive specific GDPR training and have signed agreements binding them to applicable legislation and Rule's internal security and confidentiality requirements.

Rule maintains a Data Processing Agreement and a list of subprocessors, both of which are available upon request.

The platform runs across two Availability Zones within the region. Availability Zones are physically separate facilities with independent power supplies, cooling systems and networks, ensuring that a failure in one does not affect the other.

Our primary customer database runs in a Multi-AZ configuration with automatic failover. All databases are backed up automatically, with a retention period of seven days, and can be restored to any point in time within that period.

Analytics and document databases are backed up to encrypted object storage. Backup storage is versioned, ensuring that backups cannot be overwritten or deleted without detection. Production databases are also protected against accidental deletion.

No backups, snapshots or replicas are stored outside the AWS European Sovereign Cloud.

Historically, the service has maintained an uptime of over 99.9%.

In Transit

All communication between customers and Rule takes place over HTTPS and is encrypted using TLS. Traffic within our infrastructure is routed through a private network that is not accessible from the internet. Data sent to our optional AI features is transmitted over encrypted connections (TLS 1.2 or higher).

At Rest

All customer data within the Rule platform is encrypted at rest. This includes databases, storage volumes, file storage, cache storage and all backups. Data processed by our optional AI features is encrypted at rest using AES-256.

Encryption Keys

All encryption keys for the Rule platform are stored in AWS Key Management Service (KMS) within the AWS European Sovereign Cloud in Germany. Keys protecting backups and application secrets are generated and controlled by Rule and rotated automatically. No key material is stored outside AWS KMS.

Application credentials and other secrets are stored in a managed secrets store, encrypted using a dedicated key that is separate from the keys used for stored data.

Access to the service is granted to users selected by the customer, based on their assigned permission levels. Users sign in using their email address and password, or through Single Sign-On (SSO) via Google or Microsoft Entra ID. When using SSO, two-factor authentication is managed by your own identity provider.

Passwords Are Never Stored in Plain Text

Passwords are stored as salted one-way hashes using the bcrypt algorithm, which is specifically designed for password protection and cannot be reversed to recover the original password.

Administrative access to the production environment is restricted to named personnel and granted through short-lived, role-based permissions rather than permanent access keys. Administrative access is provided through a VPN, and every administrative session is recorded.

The platform is designed so that almost nothing is accessible from the internet.

Only What Needs to Be Public Is Public

Application servers, databases, cache systems, analytics databases and message queues do not have public IP addresses. They are located in private network segments and can only be accessed from within our own network. The only components exposed to the internet are the load balancers that receive customer traffic.

Databases Are Not Publicly Exposed

No database accepts connections from the public internet, and no network rule allows open access to a database port. Connections are only possible from within the private network and only from services that require them.

All Traffic Passes Through a Controlled Entry Point

Customer traffic reaches the application through a load balancer protected by a Web Application Firewall (WAF). There are no alternative entry points.

Changes Are Made Through Code, Not Manually

Our entire infrastructure is defined as code and version-controlled. New application versions are deployed automatically from a reviewed Git repository, ensuring that every production change is logged, auditable and reproducible.

Administrative Access Is Temporary

Developers do not have permanent permissions to production environments. Access is granted by assuming a time-limited role that expires automatically. Permissions are assigned per role and per environment.

The service runs behind a Web Application Firewall (WAF) with managed rule sets that protect against common types of attacks, including SQL injection, cross-site scripting (XSS) and other injection techniques. The platform also includes protection against cross-site request forgery (CSRF) and denial-of-service (DoS) attacks.

The infrastructure is continuously monitored using automated threat detection. All administrative API activity is recorded in a tamper-resistant audit log, and security findings are collected centrally for review.

Audit logs and security findings are collected in a separate, dedicated security account within the AWS European Sovereign Cloud. This account monitors all other environments, is isolated from production and has its own restricted access controls.

The Rule platform is hosted in the AWS European Sovereign Cloud, which holds independent certifications and undergoes external audits, including ISO 27001, ISO 27017, ISO 27018, ISO 27701, SOC 2 and the German BSI C5 attestation. All AWS services used by Rule within the AWS European Sovereign Cloud are covered by these programmes.

Because Rule operates within the AWS European Sovereign Cloud, customer data is stored on infrastructure operated by EU-based personnel and subject to EU jurisdiction.

For more information, visit aws.eu/compliance.