01Who we are and our role
Ragis is provided by Ragis. For account data, such as your name and work email, we decide how it is used and act as controller.
For the documents and questions your organization puts into Ragis, your organization is the controller and we process that data only on its instructions, as its processor. A data processing agreement can be signed before onboarding.
02What we collect
- Account data: name, work email, organization, role and sign-in events from your identity provider.
- Customer content: documents you upload, the text and images extracted from them, your questions and the answers generated.
- Usage data: request IDs, timings, the model used, token counts and quota usage. Standard logs do not store full questions or document text.
03How we use it
We use data to run the Service: indexing documents, answering questions with citations, enforcing permissions and quotas, billing, support, and keeping the platform secure.
We do not sell personal data and we do not use customer content to train AI models.
04AI processing
Answers are generated by models on Amazon Bedrock, in the region agreed with your organization. Each organization has an approved list of models and regions, and requests never fall back silently to a provider outside that list. Personal data detected in documents can be redacted before indexing.
05Where data is stored
Data is hosted on Amazon Web Services, by default in the United States (us-east-1). Other regions, such as São Paulo (sa-east-1), are available on request. Private Cloud customers get a dedicated AWS account, network and encryption keys. When data leaves your country we apply the safeguards required by applicable law.
06Security
- Encryption in transit and at rest, with keys scoped per environment and, on higher plans, per customer.
- Each organization's data is isolated at the database and storage level, and permissions are checked before any passage is retrieved.
- Files are stored privately and served through short-lived signed links.
- Administrative access requires strong authentication, uses least privilege and is audited.
07Retention and deletion
Customer content is kept while your organization keeps it in Ragis. Deleting a document removes its passages, embeddings, cached answers and graph links from search.
When an organization closes its account we delete its content from the live Service. Backups expire on their regular schedule, and limited security records may be kept longer where the law requires.
08Sub-processors
We use Amazon Web Services for hosting, storage and AI model inference. We will tell organization owners before adding a sub-processor that handles customer content.
09Your rights
Depending on where you live, you can ask to access, correct, delete or export your personal data, or object to some processing. This includes the rights under Colombia's Law 1581 of 2012 and, where it applies, the GDPR.
If your data is in documents uploaded by your employer, contact your organization first; we will help them respond.
11Changes
We will post updates here and change the date at the top. For material changes we will notify organization owners in advance.
12Contact
For privacy questions or requests, use the contact listed in your agreement or order form.