Protecting your information isn’t an option, it’s the foundation of our architecture. We built Roona so that your data stays yours, permanently.
Four commitments: your files are encrypted before they leave your computer, every customer gets a sealed-off space, connecting your Google and Microsoft accounts never hands us your passwords, and everything is hosted in Europe, in line with the GDPR.
The promise: your documents are unreadable to everyone, including our own team.
Your files are encrypted before they even leave your computer. They travel and are stored as digital safes to which only you hold the key.
We use an advanced envelope system. Every document has its own unique key: if one key were theoretically compromised, the rest of your data would stay completely locked.
Your password generates a decryption key through a heavy computation (PBKDF2), which makes your content unreachable without your authentication.
The promise: a sealed wall between you and every other company.
Every user works inside a strictly partitioned space. Your documents and your AI memories are isolated within your own perimeter.
More than fifty rules, enforced inside the database itself, check who each requested piece of data belongs to, on every single query.
A display error cannot expose your data to another user: the check does not happen in the interface, but in the database, on every query. If the data requested is not yours, the query returns nothing.
The promise: an armoured door on your connected accounts.
We use the official OAuth2 protocol with hardened security (PKCE). In practice: we never have access to your Google or Microsoft passwords.
Your account is protected against brute-force attacks (automatic lockout after 5 attempts).
Our session cookies are out of reach of scripts running in the page (HttpOnly): a malicious script cannot read them in order to impersonate you.
The promise: you stay the only one in charge.
Nothing is switched on without your agreement (opt-in). Every consent is timestamped and stored so it cannot be altered.
A “Delete” button that really deletes: your documents, your conversations and your history are wiped, and the keys that made them readable are destroyed along with them.
To protect your privacy over the long run, technical data older than 180 days is anonymised automatically.
A question about your data? Our Data Protection Officer can be reached at rgpd@roonaworks.com.
The EU AI Act applies in stages, the main one since 2 August 2026. We apply each deadline as it comes, and Roona drafts and prepares without ever taking a decision about a person.
Article 50 requires you to disclose what an AI generated or altered. For a home staging, a virtual try-on or a generated voice, say so on your materials: it is simple, and it is what the regulation expects.
A voice is cloned on explicit consent, and only your own. That is exactly what the regulation demands of content that imitates a real person.
Roona runs on the strongest models on the market, used under enterprise agreements: your documents serve to produce your answer, never to train a model. State of the art, without paying for it in data.
Your documents are encrypted and stored in Europe, and your supervisory authority is the one of your own country. When you have a question, you talk to a regulator who applies your law, not a legal department six thousand kilometres away.