Switching and exit
Last updated: 11 October 2026
Articles 26 and 28 of the EU Data Act require a provider to publish how a customer leaves, in which formats data comes out, and where the infrastructure holding it runs. That is what this page does, and what it states is what RateLoop commits to. The processor-side commitments are in the Data Processing Addendum.
What you can export, and in what format
Every export below is UTF-8 JSON with documented fields. There is no proprietary container, no export licence, and no RateLoop software is needed to read one afterwards.
| Export | What it contains | How to obtain it |
|---|---|---|
| Decision evidence packet | The frozen question, the reviewer reports, the aggregation, the pass rule, and the digests binding them. | Results in the workspace, or GET /api/account/workspaces/{workspaceId}/assurance/runs/{runId}/evidence |
| Review coverage export | Sampling stages, the applied review rates, and the coverage counts behind them for a chosen period. | GET /api/account/workspaces/{workspaceId}/assurance/coverage/export |
| Workspace audit chain | The append-only record of workspace actions, actors, and purposes, together with its head digest. | GET /api/account/workspaces/{workspaceId}/audit/export |
| Personal data copy | The personal data RateLoop holds about one signed-in person across accounts, assignments, notifications, access events and Chat, including their saved online source-check reports. | Requested in account settings; the generated file stays available to the requesting person for seven days. |
The field reference for each of them is on the evidence reference. What no export contains: material RateLoop never held, records belonging to another provider, and the content of your own upstream systems.
Checking an export without us
Packets already issued stay checkable without RateLoop. The browser checker runs locally and uploads nothing, and the single-file offline verifier has no dependencies and contacts nothing.
Do one thing before you leave rather than after. A signature is only as good as the key pin you check it against, and the pins are served by the public verification-key endpoint — which is ours. Save the current and retired pins next to your exports while that endpoint is still reachable. Never treat the public key carried inside a packet as its own trust anchor.
The switching procedure
- Tell us in writing. An email from a workspace owner to hello@rateloop.ai is enough. Name the workspaces and the intended end date.
- We confirm within two working days the end date, the transition window, and one named contact for the move. The first reply follows the next-working-day target on the support page; the two days are for that written confirmation.
- Transition: 30 days. The service keeps running and you export at your own pace. Where a move is genuinely not technically feasible within 30 days, the window is extended by agreement in that individual case, to a maximum of seven months in total.
- Retrieval: a further 30 days at least. Review work has stopped, but the exports above stay available to you.
- Erasure. After retrieval, RateLoop erases Customer Personal Data and confirms the erasure in writing, naming what was erased and what was retained under the limits below.
RateLoop charges nothing for switching, for any export on this page, or for the assistance in step 2. Article 25 of the Data Act caps the notice period for starting a switch at two months, and RateLoop commits here to that cap for either side. Nothing on this page shortens a customer's own termination rights under the applicable order.
What erasure does not cover
- Records under a statutory retention duty — accounting, tax, and dispute records — are kept for their legal period and restricted rather than erased.
- A workspace's configured evidence retention keeps running. RateLoop does not delete evidence early merely because a subscription ended, and retention cannot be configured below six months.
- Integrity records survive content deletion. Artifact digests, issued packets, witness receipts, and the audit chain remain, so removing private content does not rewrite the history of what happened.
- Backup copies expire on their own schedule rather than on the day of the erasure confirmation.
Where the infrastructure runs
RateLoop’s web and database workloads use configured EEA regions. This does not establish the location of external Chat or API generation or online source checks. Provider jurisdiction and processing location are shown separately below.
| Provider | What runs there | Configured processing region | Provider's jurisdiction |
|---|---|---|---|
| Vercel AI Gateway and its routed model providers | Hosted Chat and owner-authorized API text generation, plus explicitly requested online source checks. | Depends on Gateway routing and upstream provider settings; no EEA processing location is established by the web application region. | Vercel is incorporated in the United States; the routed provider and applicable agreement determine the upstream jurisdiction. |
| Vercel, Inc. | Web application hosting, edge delivery, server functions, scheduled maintenance and delivery jobs, private object storage, and operational request logs. | EEA, Frankfurt region (fra1). | United States. |
| Railway Corp. | Managed PostgreSQL and the hosted Rating AI evaluator, including permitted inference, training, and private routing learning. | EEA, Netherlands region (europe-west4). | United States. |
| Resend, Inc. | Outbound email, where configured. | EEA dispatch from Ireland; account metadata and sending logs stay in the United States. | United States. |
| Stripe Payments Europe, Limited and Stripe affiliates | Subscription billing, where used. | EEA, Ireland. | Ireland, with affiliates outside the EEA. |
| Sigstore public Rekor service | Public witnessing of digests and limited attestation metadata. | Public infrastructure operated outside the EEA. | United States. |
This is a processing-region statement, not a residency attestation. A provider's control plane, its managed backups, and its remote administration may sit elsewhere; RateLoop can configure a region and read what a provider states, not inspect where a provider actually places every copy. An EEA region also does not change the law that applies to the provider itself. Covered transfers outside the EEA rely on an applicable adequacy decision or the European Commission's standard contractual clauses with supplementary measures.
The complete list, including providers that receive data only when an optional feature is switched on, is on the subprocessor page, which also carries the advance change notice and the objection right.
If RateLoop stops operating
RateLoop is operated by a small company, Hawig Ventures UG (haftungsbeschränkt). That is a real concentration risk, and the answer to it is mechanical rather than reassuring.
- The hosted application is proprietary. Its private APIs, persistence layer, operational services, deployment tooling, and commercial logic are not open source.
- Some portable components use the MIT licence. The SDK, agent helpers, evidence verifier, n8n node, Node utilities, and the offline verifier script are separately MIT-licensed. Package install instructions apply only after npm lists the named version. Those components can help read exports or move an integration, but they are not a runnable copy of the hosted service.
- Evidence you already hold does not need us, provided you kept the key pins described above.
- An orderly shutdown follows the procedure above and is announced by email to workspace owners.
- What does not exist, and is not promised: there is no source-code escrow agreement, no key or database escrow with a third party, and no deputy holding contractual access. An insolvency would not honour a notice period. Export early and keep your own copies instead of relying on a promise about our continuity.
Questions and competent authorities
Switching questions go to hello@rateloop.ai. For the Data Act, the competent authority in Germany is the Bundesnetzagentur; for the personal-data aspects of an exit, the supervisory authority named in the privacy notice is competent.