Security & Trust

Short answers to the questions a security review asks first — and the same commitments in both jurisdictions.

Counterparty

EU An Irish company, incorporated and operating in the European Union under EU law, separate from the US entity. RocketX Limited, Company No. 344153, registered office Derrylahan, Ballyhaunis, Co. Mayo, F35 W667, Ireland.

US RocketX LLC, the United States entity. Same platform, same commitments, governed where you are.

Data residency

EU Customer data stays in the European Union: storage, processing and backups. Nothing is replicated to the United States.

US Customer data stays in the United States: storage, processing and backups. Nothing is replicated to the EU.

Certifications

EU EU facilities certified to ISO/IEC 27001:2022 and BSI C5 Type 2.

US The same provider and the same operational controls. Facility attestations for the US sites are available on request.

GDPR

EU Applies to the engagement directly. You are the controller of your customer and order data; we are the processor, acting on your documented instructions.

US CCPA and CPRA, and the successor state statutes, are handled through the same written processing terms rather than a separate regime per state.

Subprocessors

Disclosed in full, with notice before any change and a contractual right to object.

Security review

Certifications, audit reports and hosting detail are provided on request and attach to the agreement.

Named users, attributable actions

Seats and users are unlimited on every plan, with no per-user charges — so there is never a commercial reason for shared logins. Several people can work the same cart at once, and every change is attributed to a named person and timestamped.

What the agreement puts in writing

• Data processing agreement, with roles written down
• Current subprocessor list, with change notice
• Hosting regions for your data, named in writing
• Uptime and support commitments, by tier
• Retention, deletion and backup policy

For regulated industries

Pharmaceutical and life-science wholesalers assess suppliers against 21 CFR Part 11 and EU Annex 11. The properties those assessments look for first — unique named accounts, attributed and timestamped changes, written retention and deletion policy, a current subprocessor list — are described above, in the contract, or both. We support supplier-qualification audits, and validation against your own SOPs happens where it belongs: in the pilot, against agreed measures. We do not claim a certification we do not hold.

This website

It practices the same restraint: no trackers, no cookies, fonts served from this domain. Details in the privacy notice.

Ask directly

Security questionnaires and audit questions: app@rocketx.app. We answer them ourselves.