Compliance and certification
Regulations named#
R2 does not store, collect or share user-generated content, and uses data encryption to comply with a range of privacy regulations, including:
- GDPR — European Union general data protection regulation
- HIPAA — United States health information privacy
- CCPA — California consumer privacy
These are the regulations the vendor states the product is built to comply with. A formal attestation for your own audit file is requested through the contact form.
Microsoft Solutions Partner#
R2 Copilot for Marketing has attained Microsoft Solutions Partner status, certified under the Industry AI on Azure program. The certification covers a solution built to the Azure Well-Architected Framework, maintaining "Moderate" or higher scores across Reliability, Security and Operational Excellence, and running entirely within Azure.
The product pages also carry Microsoft Solution Partner designations for Digital & App Innovation (Azure), Data & AI (Azure) and Infrastructure (Azure).
Who the publisher is#
The Microsoft marketplace listings for the add-ins are published under Stealth Mail, and Microsoft's app certification page for R2 Copilot lists Stealth Mail as the partner company, with headquarters in Ukraine.
Stealth Mail and R2 Copilot are the same vendor: R2 Copilot is the product, and Stealth Mail is the company that publishes it in the Microsoft store. If your procurement checks match the publisher name against the contract counterparty, this is the page to point at.
What is a certification and what is a design claim#
Being explicit about this saves a round-trip during a review:
| Statement | Kind |
|---|---|
| Microsoft Solutions Partner, Industry AI on Azure | Certification held, verifiable with Microsoft |
| Azure Well-Architected scores of "Moderate" or higher | Assessment against a Microsoft framework |
| Runs in Azure with encryption at rest and RBAC | Architecture, described on What is stored |
| Complies with GDPR, HIPAA, CCPA | Vendor statement based on the above; ask for the attestation your auditor needs |
| SDNP and Last Mile Protection | Patented technology, see How R2 keeps content private |
For your vendor review#
Request through the contact form: the data processing agreement, the processing region for your tenant, the sub-processor list, and written confirmation of deletion practice. Say which of your entities is contracting and which regulation your review is against — the answer differs for HIPAA and GDPR.
Next#
- What is stored and what is not — the concrete list a reviewer asks for.
- Plans and pricing — advanced protection is part of the enterprise plans.