This Privacy Policy applies to Republic of Trust, a service operated by Samarkand Industries OÜ, a private limited company (osaühing) registered in Estonia under registry code 17492007, with registered address at Narva mnt 5, 10117 Tallinn, Harjumaa, Estonia, European Union. VAT EE102996999. We collect personal data only where we have a lawful basis for doing so, and the platform is built so that people who report wrongdoing can do so without giving us their identity at all.
Republic of Trust is operated by Samarkand Industries OÜ (“we”, “us”, the “operator”).
Our role under the GDPR depends on the data in question:
Reporters are anonymous by design. When someone files a report they receive a case reference and a case password. We do not ask for, and do not store, a name, email address, account, IP address or device identifier tied to a report. Report text, any voice message and any attachments are provided by the reporter; uploaded files are stripped of hidden metadata before storage, and reporters are advised not to include identifying details they wish to keep private.
Data we collect directly:
| Data | Context |
|---|---|
| Report content, category, voice message, attachments | Submitted by an anonymous reporter into a client’s reporting channel |
| Name, work email, hashed password, encrypted MFA secret | Case handler and administrator accounts of client organisations |
| Name, work email, organisation, message | Demo requests submitted on our website |
Data we collect automatically:
| Data | Context |
|---|---|
| Minimal server and security logs | Operating and securing the service; abuse and error diagnosis |
| A strictly necessary session cookie; a language preference | Keeping authenticated users signed in and remembering language. See our Cookie Policy. |
| Processing | Legal basis (GDPR Art. 6) |
|---|---|
| Providing the platform to client organisations and their users | Art. 6(1)(b) — performance of a contract |
| Securing the service, preventing abuse, responding to demo requests | Art. 6(1)(f) — legitimate interests |
| Meeting our legal and regulatory obligations | Art. 6(1)(c) — legal obligation |
| Processing reports on a client’s behalf | The client’s basis as controller, including Directive (EU) 2019/1937; we act under Art. 28 as processor |
We use personal data to operate Republic of Trust, to authenticate and support client users, to keep the service secure, to meet compliance obligations, and to respond to demo enquiries.
We share data only with the sub-processors needed to run the service, each bound by a data-processing agreement and acting on our instructions:
| Sub-processor | Purpose | Data residency |
|---|---|---|
| Vercel | Application compute and hosting | EU (Frankfurt region) |
| Neon | Managed PostgreSQL database | EU (Frankfurt) |
| Cloudflare R2 | Encrypted attachment storage | Western Europe |
| Resend | Transactional email to client users | EU sending region |
Report bodies, MFA secrets and attachments are encrypted with our own key before they reach any sub-processor, so storage and email providers never see report content. We are migrating data-at-rest providers to EU-owned alternatives; the current list is always available on request.
International transfers. Personal data is processed within the European Economic Area. Where a transfer outside the EEA cannot be avoided, we rely on an adequacy decision or the European Commission’s Standard Contractual Clauses.
We use no analytics or tracking service. There is no third-party analytics vendor in our stack, and the reporter portal makes no external requests — fonts are self-hosted so that a reporter’s browser never contacts a third party.
| Data | Retention |
|---|---|
| Case and report data | As required by the client organisation’s instructions and the retention period of its jurisdiction under Directive (EU) 2019/1937; then purged |
| Client user accounts | For the life of the account, then deleted or anonymised |
| Demo requests | No longer than needed to follow up on the enquiry |
| Audit logs | Retained to evidence compliance, as a compliance record |
Under the GDPR you have the rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20) and objection (Art. 21). We respond within 30 days.
Because reporting is anonymous, we often hold no information that identifies you as a reporter and therefore cannot connect a rights request to your report without your case reference. For data where we are a processor, we will forward your request to the relevant controller.
You may lodge a complaint with our lead supervisory authority — Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate), Tatari 39, 10134 Tallinn, Estonia — aki.ee — or with the authority in your country of residence.
We encrypt data in transit and at rest. Report bodies, MFA secrets and attachments are additionally encrypted at the application layer with our own key; uploaded files are stripped of metadata before storage. Tenants are isolated at the database layer, access is role-controlled, and privileged actions are written to an append-only audit log.
We may update this policy from time to time. We will post the revised version here and update the date above. Continued use after notice constitutes acceptance.
Controller: Samarkand Industries OÜ, a private limited company (osaühing) registered in Estonia under registry code 17492007, with registered address at Narva mnt 5, 10117 Tallinn, Harjumaa, Estonia, European Union. VAT EE102996999.
Data protection enquiries: privacy@republicoftrust.eu. Supervisory authority: Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate), Tatari 39, 10134 Tallinn, Estonia — aki.ee.
This document is published by Samarkand Industries OÜ for Republic of Trust. It is provided for information and does not constitute legal advice.