Security and protocol

What a security lead or a DPO reads first.

Every line describes what is in place today, and separates what is planned from what is certified. Last updated: 7 September 2026.

Document hosting: With a French provider, in France (Scaleway, Paris region). Files are encrypted before storage; the storage never sees plaintext.
Record and metadata hosting: In the European Union.
Encryption: One key per room (AES-256-GCM), created when the room opens and kept in a vault. Names, questions and metadata are encrypted with the same key.
Closing: At closing, the room key is disabled, then destroyed after thirty days. The closing archive is encrypted with a key of its own.
Archive retention: Ninety days for an invoice dispute, one year for a company sale. The archive is never deleted before every entitled party has retrieved it; each retrieval is itself recorded.
Record: One append-only chain per room: each entry is linked to the previous one by hash. Any change shows at verification, including one by our own administrators.
Verification: Export of the record and verification on your own computer with the public tool of the VAL protocol (val-protocol.org, Apache-2.0), with no account with us. Verification covers the record, not the substance of the dossier.
AI assistants: An assistant acts within the technical scope delegated to it by a person, never beyond. It cannot sign, consent or legally bind the party. Its actions are recorded as software actions.
Access to the parties’ systems: None. Each organisation connects its own tools with its own credentials; RIGA holds no access into any party’s information system.
Access control: Roles and rights per party, checked on every action. Two-factor authentication available for every account; an organisation can require it of its members. Every view and every action is recorded in the room’s record.
Subprocessors: Documents: Scaleway (France). Database, record and keys: Supabase (European Union region, US-operated). Network and access: Cloudflare. Billing: Stripe. Coordination-agent model: run on our own servers or through Anthropic’s API. The contractual list is in the data processing agreement.
Data processing agreement: Provided on request to [email protected], with the subprocessor list and the technical measures described here.
Certifications: No ISO 27001 or SOC 2 certification is held to date. The mechanisms described on this page are in place and verifiable; certification is a separate undertaking, announced here when it is complete.
Planned, not enabled: Qualified timestamping of the record (RFC 3161) is shipped in the product and verified by the same tool; it is not enabled in production. Until it is, no page mentions timestamping.

Full technical documentation: developers page. Security questions: [email protected].

Product reference

What the shared workspace guarantees, in detail.

Technical delegation, acts reserved to people, signature levels, offline verification, closing, hosting: the product page says what it is, this page says how.

The neutral space

Operating the room grants no power over the record.

Whoever commissions it — one side, both, even us — there is one record, the same for every party; no one can rewrite it unnoticed, and any party can verify it without trusting the others, or us. Inside it, the work and the automation continue: humans, and the AI agents acting for them, under authority that is delegated, revocable, that an agent can never exceed — and that never includes signing or consenting.

What makes a space neutral

—

No one arbitrates. We are party to nothing: we record who did what, under whose authority. Opening the space grants no control over the record — nor does paying for it.

—

Every party can verify. The record recomputes on your machine, with no account and no connection, with an open-source verifier published under a name independent of us. It outlives the matter, the software, and us.

—

Authority is bounded and traced. Every action traces to a person who authorised it. A delegated assistant never exceeds its delegator; restricting the delegator restricts the assistant from its next action; and it neither signs nor consents — ever.

—

The same pieces, on both sides. What is exchanged has no private version: each party sees what was sent to it, asked of it, answered to it — and can respond.

—

An ending that belongs to you. When the room closes, every signatory of the outcome walks away with the same file — the terms, the consents, the full history, a report that verifies itself — sealed so that each copy proves its own authenticity. We host an encrypted copy for a limited period, and never delete it before every entitled party has provably taken theirs. Your copy is the record.

—

Usable as is, with an AI assistant, or from your own tools. Use the space as it is; plug your assistant into it; or embed it entirely in your workflow through API and MCP. Three depths, one workspace — a link in your chain, not another portal.

Delegation

Each party delegates its own agent, under a signed mandate.

Bring your agent from Claude, Cowork or any compatible MCP client, and delegate it in one click. An agent never exceeds the rights of the person who delegated it: what it can do is recomputed at every act, from its delegator's actual rights at that instant.

Over-delegation has no effect. Restricting the delegator's access restricts the agent from its next action; extending it requires a new signed delegation. Anyone can revoke their own agent, at any time.

Mandate — Claire T.'s agent

Signed delegation

by Claire Tricat · Tricatel party

Profile B

The mandate composes:

readuploadgrounded questionsproposesigndestroy

Recomputed at every act · isolated to its party

Revoke

Agent surface — tools/list (excerpt)

✓ document_read · document_upload

✓ task_propose · qa_answer

✓ resolution_propose

∅ consent — no tool, on any surface

∅ sign — no tool, on any surface

The human boundary

Some acts remain human, by construction.

—Consent, sign never delegable, at any mandate level;
—Ratify or retract an act — reserved to the delegator;
—Destroy or dispose only under an express, separate mandate;
—Close the room seals after every party's consent.

No mandate, at any level, composes these acts for a machine.

Profiles A / B / C

Each instrument carries its proof level — exact, never rounded.

Each instrument — a delegation as much as a consent — carries its own conformance profile, enforced the moment the instrument is born: a mandate below the organization's floor is refused, with a typed error.

The chain reports the weakest profile present and declares the key's nature: device-bound, syncable, or unattested.

A — operator-attestedB — device-signed (WebAuthn)C — eIDAS qualified signature

Response — conformance floor

{ "error": {
    "type": "invalid_request_error",
    "code": "grant_profile_below_floor",
    "message": "Grant conformance profile A is below
      this organization's minimum profile floor (B)."
} }

The floor applies at the instrument's birth, before any act.

Independent verification

The full chain verifies offline, by anyone.

Export the chain to a file and verify it with the VAL protocol's public tooling — open (Apache-2.0), runnable without a single call to us. If we lied about a single act, verification would fail on your machine.

Timestamp anchoring (RFC 3161) is validated by the same verifier, down to the CMS signature — proven against real TSA tokens, including forged ones. An unanchored chain verifies fully; an anchor verifies or is reported absent, never assumed. Anchor issuance ships in the substrate, behind an activation gate.

$npx @val-protocol/demo

Closure

And it ends.

When the room closes, every signatory of the outcome walks away with the same file — the terms, the consents, the full history, a report that verifies itself — sealed so that each copy proves its own authenticity. We host an encrypted copy for a limited period, and never delete it before every entitled party has provably taken theirs. Your copy is the record.

If you lose your copy, any signatory's copy — including the other party's — restores the file: authenticity does not depend on who holds it; every copy re-hashes to the identical value against the seal.

Platform

An infrastructure of authority and proof. Hosting: France + European Union.

Encryption

One key per room, retired at closure

AES-256-GCM per room. Closure retires the key from service; it is destroyed after a 30-day retention — cryptographic erasure.

Residency

Documents in France, chain in the EU

Encrypted documents are hosted in France; the chain and metadata in the European Union.

Proof portability

The record verifies outside our infrastructure

The exported chain verifies outside any infrastructure, with the protocol's public tooling.