CELLAR
Security & Compliance

Built to be diligenced

Cellar runs the operational due diligence you owe your counterparties, so we hold the platform to the same standard. EU data stays in Luxembourg, on ISO/IEC 27001:2022 certified infrastructure, operated by a CSSF-supervised PSF.

Request our security pack
Hosting & data residency

Your data stays in Luxembourg

No transfer outside the EU. Cellar runs on a Luxembourg private cloud, in sovereign datacenters, operated by a regulated financial-sector professional.

EU data residency

All customer data is hosted in the European Union, in LuxConnect datacenters in Luxembourg. Nothing leaves the Union.

Sovereign datacenters

LuxConnect is Luxembourg's state-owned, carrier-neutral datacenter operator, purpose-built for critical and financial workloads.

Operated by a PSF

The platform is run by RCube, a Luxembourg Professional of the Financial Sector, supervised by the CSSF.

Certifications & regulatory status

Independently certified, not self-declared

ISO/IEC 27001:2022
Cellar runs on ISO/IEC 27001:2022 certified infrastructure. The R-Cloud platform operated by RCube falls within the certified ISMS of Rcarré S.A. (certificate CT-ISMS-052025-0CU01500), valid to 21 May 2028.
CSSF-supervised PSF
RCube holds Luxembourg PSF authorisation N°32-19 (Ministry of Finance) and is supervised by the CSSF, part of the Rcarré group.
GDPR / RGPD
Personal data is processed within the EU under the GDPR. RCube maintains a documented data-protection policy.
CSSF 22/806 & DORA
Cellar is built to CSSF 22/806, and hosting by a CSSF-supervised PSF supports your own outsourcing and DORA due-diligence obligations.
Testing & resilience

Tested, not just documented

Independent penetration testing

The R-Cloud platform is penetration-tested by iTrust, an independent Luxembourg security firm, on a recurring basis.

Business continuity & DR

Business-continuity and disaster-recovery plans are maintained and regularly tested, not just written down.

Internal control & audit

The hosting operation is covered by internal control and audit reporting, with ongoing monitoring of the platform.

Access & data protection

Least access, full trace

Enterprise SSO

Users sign in with Microsoft or Google. No separate Cellar password to create, store or leak.

No passwords for recipients

Delegates answer through a single secure, time-limited link, with no account to create and no password to manage.

Full audit trail

Every questionnaire, document, score and review action is captured in one auditable trail, ready for your board and your regulator.

Transparency

The hosting chain, in full

No hidden third parties. Here is exactly who runs the infrastructure behind Cellar.

RCubeOperator · CSSF-supervised PSF
Rcarré groupISO/IEC 27001:2022 certified
LuxConnectSovereign datacenters, Luxembourg

Cellar's application relies on a small set of vetted sub-processors (enterprise SSO, transactional email, AI processing). The complete, current sub-processor list is included in the security pack.

Run your due diligence on us.

Request the full documentation under NDA: ISO 27001 certificate, penetration-test summaries, BCP / DRP evidence, policies and the sub-processor list.

Request our security pack

Certifications and regulatory status refer to Cellar's hosting providers (RCube and the Rcarré group). Cellar is the software; the certified infrastructure is the platform it runs on.