One database per company
Your company's data sits in a database of its own, separate from other customers'. Migration and export are done company by company.
Trust and security
Where your data lives, who sees it and how you take it back
Rental software holds your contracts, documents and customer data. Here is what NoloForWeb actually does to protect them, which suppliers receive them and what we put in writing before you sign.
One database per company No card numbers stored Full export whenever you want
How we protect it
Measures already in the product
Passwords never in clear text
Operator passwords are stored only as a hash (PBKDF2), and after 5 wrong attempts in 15 minutes sign-in is locked. Those imported from an old system are converted at first login.
Role-based permissions
Each role has separate read, write, insert and delete permissions, and each operator only gets into the branches they are enabled for.
Activity log
Logins, pages opened and every data change are recorded, with the value before and after. Passwords and keys stay masked in the log too.
Encrypted credentials
Passwords and keys for connected services (SdI, CaRGOS, SES.HOSPEDAJES, DGT, SMS, signature, payments, AI) are stored encrypted.
No card numbers
The system stores no card numbers, expiry dates or security codes: Nexi handles them. An automated test stops anyone reintroducing them.
External suppliers
Who receives the data, and when
Each external service receives only the data it needs, and almost all of them run only if you switch them on. Reports to the authorities (CaRGOS, SES.HOSPEDAJES, DGT) go straight to the public bodies.
| Service | Supplier | What it receives | When |
|---|---|---|---|
| System hosting | Aruba | All the system's data | Always |
| The mail server you set, or Rilogi's own (info@rilogi.it) | Recipient and message text | Every email sent | |
| Text messages and e-signature | OpenAPI | Phone number; document and signer details | Only if you switch them on |
| Meta (WhatsApp Cloud API) | Number and message text | Only if you switch it on | |
| E-invoicing | Aruba | Invoice data | In Italy, if you switch on SdI |
| Payments | Nexi | Amount and payment reference; card details stay with Nexi | Only if you switch them on |
| Artificial intelligence | Anthropic (Claude) with Rilogi's included AI, or the supplier you choose with your own key (OpenAI, Azure OpenAI, Anthropic, Google Gemini) | The text or image of the single request | Only if you switch it on |
On www.noloforweb.eu, Google Analytics runs only if you accept statistics cookies; the rental system has none.
Questions we get before signing
Who provides the service?
RICLOG, NIE Z4002038C, based in 35008 Las Palmas de Gran Canaria (Las Palmas), Spain. The service agreement is a separate document you receive before signing.
Where is the data hosted?
In Europe, with Aruba.
How often is data backed up?
Every day. Copies are kept for 15 days on a separate Aruba backup server, and restoring a company takes about 30 minutes.
If the service stops, who answers?
Support answers every day from 9:00 to 20:00, Italian time: reports arrive in real time and are handled in order of priority. How reporting works is explained at www.noloforweb.eu/en/support.
How do I take my data back?
The administrator can download at any time a ZIP archive with 12 Excel files, one per area: customers, fleet, quotes, bookings, contracts, invoices, fines, damage reports, price lists, brokers, compliance and configuration, plus documents if wanted. A 6-digit code sent by email is required; the file stays available for 7 days and every download is logged.
Who controls my customers' data?
You do. We process it on your behalf as a data processor (Article 28 GDPR). With the contract you receive the data processing agreement: which data we process and why, the security measures on this page, the suppliers in the table above, help with your customers' requests and the return or deletion of the data when the service ends.
What if there is an incident?
We tell you straight away, as soon as we notice: what happened, which data is involved and what we are doing, so you have time to assess notifying the authority within 72 hours. Your contact is Riccardo Lo Giudice (info@rilogi.it).
Is my data used to train AI?
We do not train models on your data. If you switch AI on, each request goes to Anthropic (Claude) with Rilogi's included AI (on credits, with a monthly cap in the contract) or to the supplier you chose with your own key, under its terms. Damage, extracted data and prices remain proposals: the operator decides.
Is connecting an assistant through the MCP server safe?
Access goes through OAuth and opens one company at a time. Actions that write, such as creating or cancelling a booking, show a preview first and run only after confirmation.
What happens if I leave?
You export the data as above. If you also need a full copy of the database, we prepare it from the backup and restore panel, in the time the operation takes; once it has been handed over we delete your data, and the backup copies expire by themselves within 15 days.
Need documents for your privacy officer?
Ask us for the service agreement, the data processing agreement and the current supplier list: we send them before you sign.