Protect
Content is encrypted on the device with a key the institution controls, before it reaches any provider.
Rhea Data
One environment for your organization's data.
Rhea Data is authority: the control plane for the storage and databases the institution already runs. The bytes do not move to Rhea. The decision does. Nothing in Rhea Data is done except through Rhea Key. The customer connector can still refuse an action, and an agent signature is never a human approval.
One access point
Every provider. One place to reach it.
- Keep data in the clouds you already pay for
- Unlimited storage and database connections
- The connector can refuse; an agent signature is never a human approval
Category
Rhea Data is not storage.
It sits above the providers. Above means the decision, not a new place your bytes pass through.
ProductIt is notIt is
Storage
It is notRhea does not host, sync or back up your files.
It isYour buckets and databases keep the data: AWS S3, Azure Blob, Google Cloud Storage, Cloudflare R2, Oracle, MinIO.
Permission
It is notPolicy never grants an action on its own.
It isPolicy narrows. Only a Rhea Key signature grants. Your connector can still refuse.
Agents
It is notAn agent signature is never a human approval.
It isMachines get a bounded identity: one operation, a time window, revocable.
Record
It is notRhea cannot cause the work to happen.
It isRhea records that the action happened.
The seven operations
Everything an institution does to data, governed as one model.
Rhea Data does not add another place to put files. It governs the seven things that actually happen to information, wherever that information already lives.
Organise
A catalog of every protected object and record across every connected estate, with classification, placement policy and search.
Authorise
Policy decides whether an operation may run; a customer-held key proves the authority to run it. Sensitive operations require quorum.
Access
Content becomes readable only through an authorised, short-lived, single-use release, evaluated fail-closed.
Share
Protected sharing inside and outside the institution, and controlled inbound collection, without handing out links that outlive the relationship.
Move
Movement between locations and across providers as one governed operation, verified at the destination.
Audit
Every operation writes a hash-chained record of actor, action, resource, time and outcome, verifiable offline.
One authority model.
The same key, the same policy evaluation and the same evidence chain apply to all seven, across every connected estate.
Zero Custody architecture
Rhea coordinates the operation and cannot perform it alone.
The asymmetry is deliberate. Authority is manufactured on the institution’s side of the boundary, and execution happens there too. Rhea holds the workflow, the policy decision and the evidence — never the keys that make data readable.
Institution
Holder key
A person or an executive quorum signs the request on their own device with Rhea Key. The private key never leaves it.
Holds: Private signing key
Rhea
Coordination
Rhea evaluates policy, sequences the operation and records it. It carries a signed instruction, not a credential.
Holds: Ciphertext and metadata
Institution
Connector in your VPC
A connector inside the customer's own network holds every provider credential and every decryption key, and performs the operation.
Holds: Provider credentials · decryption keys
Institution
Your storage and databases
Object storage and relational estates the institution already owns. Nothing is migrated and nothing is copied to Rhea.
Holds: The data itself
Five planes
One architecture, five separated responsibilities.
- Authority
- Who may act. Keys held by people and executive quorums, delegations held by machines, all revocable and all expiring.
- Catalog
- What exists. Every protected object and governed record across every connected provider and database, classified and placed by policy.
- Policy
- What is permitted. Rules evaluated fail-closed: if policy cannot be read, the operation is denied rather than allowed.
- Execution
- What actually runs. Standard, Hardened or Zero Custody — in the strongest mode, entirely inside the customer's own VPC.
- Evidence
- What can be proven. A hash-chained ledger where each entry commits to the last, so retroactive edits break verification.
Execution modes
Choose how much Rhea is allowed to touch.
Standard
Rhea operates the execution path. Content is still encrypted on the device before it reaches storage, so Rhea handles ciphertext and metadata.
Fast onboarding for regulated mid-market teams.
Hardened
Storage credentials are sealed on the customer's own device and opened only in browser memory. Rhea holds an envelope it has no key for, and signed requests go straight from the browser to the customer's storage account.
Organisations that cannot let a vendor hold cloud credentials.
Zero Custody
A connector inside the customer's VPC holds every provider credential and every decryption key. Rhea coordinates the workflow without holding those keys. Zero Custody is not generally available.
Central banks, governments and national defence.
Bring your own storage
Your estate stays yours. Rhea never becomes the storage.
Institutions connect the object storage and relational estates they already operate. There is no migration programme, no second copy of the data, and no dependency that makes leaving expensive.
AWS S3
Customer-owned buckets
MinIO / S3-compatible
Customer-owned, connected in place
Microsoft Azure Blob Storage
Customer-owned, connected in place
Google Cloud Storage
Customer-owned, connected in place
Oracle Cloud Object Storage
Customer-owned, connected in place
Cloudflare R2
Customer-owned, connected in place
Private and on-premises infrastructure
Customer-owned, connected in place
Databases (PostgreSQL and supported relational estates)
Governed in place, no migration
Provider names identify supported environments. Inclusion does not imply partnership, endorsement or certification.
Maturity
What Rhea Data is today
Rhea Data governs data across customer-owned object storage and relational estates. Organisations connect the infrastructure they already run — AWS, Azure, Google Cloud, Oracle, Cloudflare, MinIO, on-premises — without migrating anything.
Use Rhea Data to organize protected documents, request files from outside parties, share with defined members, approve sensitive actions and review what happened. The Command Center brings operational usage and organizational visibility together.
Ownership
Who deploys and uses Rhea Data.
Rhea Data is for organizations that need important information to remain protected and usable across teams, with controlled access, customer-owned storage and recorded activity. Security and infrastructure teams configure the environment; business teams use it for everyday data work.
- Sponsored by: Security, technology, data-protection or operational leadership.
- Operated by: Security, platform, cloud or data-infrastructure teams.
- Used by: Teams handling important organizational files.
- Extended to: Clients, partners and contractors through controlled sharing and collection.
LimitationRhea Data serves people, executive quorums, applications and AI agents through one authority model: scoped, expiring, revocable and recorded.
Data operations
Put protected information to work.
Documents organized for the people authorized to use them.
Protected documents
Organize sensitive files in a document vault with folders, search, filters and per-item actions.
The organization keeps one place for the files it cannot afford to lose control of.
Evidence Access, sharing and lifecycle events are recorded.
Read moreClient-side protection
File contents are encrypted on the device with AES-256-GCM before connected storage receives them.
Storage receives protected objects, not readable content.
Rhea Data does not protect plaintext after an authorized decryption, and cannot eliminate risk on a compromised authorized endpoint.
Read moreEncrypted filename and folder metadata
Protect filenames and folder structure in addition to contents.
Closes the most significant remaining metadata exposure.
Exchange
Getting data in and out under control.
Collection and sharing stay inside the organization's protection model.
Secure File Requests
Request and receive sensitive files from people inside or outside the organization without defaulting to ordinary attachments or uncontrolled upload links.
Inbound sensitive material enters the organization's protection model at the point of collection.
Evidence Request creation, submission and receipt are recorded.
Read moreShared Access Control
Share protected folders and files with defined members and keep the organization's access model intact.
Sharing does not mean handing out a link that outlives the relationship.
Evidence Member additions, removals and file access are recorded.
Read moreSecurity operations
Running protection as an operation, not an assumption.
Access and approvals
Apply roles and permissions, and require Rhea Key approval for sensitive actions.
Authority to read is a decision the organization makes, not a side effect of infrastructure access.
Evidence Authorization decisions and approvals are recorded.
Read moreEncryption health
Review protection coverage, key versions, and re-wrapping state across the organization's documents.
Protection state becomes an operational metric instead of an assumption.
Read moreSessions and security alerts
Review active sessions and security alerts, and end sessions when required.
Access that is no longer appropriate can be ended immediately.
Read moreGuardian key recovery
Recover organizational key material through a configured threshold of guardians who each hold their own key and give a signed, single-use consent.
Continuity does not require Rhea to hold a copy of the organization's authority.
If a guardian loses both their Recovery Kit and its passphrase, that guardian's share is permanently lost.
Read moreRetention and archive
Configure retention, archive documents, and control trash behavior.
Sensitive material has a defined end of life.
Read moreClassification
Classify documents so that policy and review operate on sensitivity, not only on location.
Controls follow the sensitivity of the information.
Infrastructure
Your storage. Your account. Your control.
Rhea Data connects to storage the organization already owns and operates.
Bring Your Own Storage — six provider families
Connect the organization's own AWS S3, Azure Blob, Google Cloud Storage, Oracle, Cloudflare R2 or MinIO storage, validate it, test the transfer path, and operate it from Rhea Data.
The organization keeps ownership of the storage account holding its protected objects.
Read moreData Explorer and connector health
Browse protected data across every connected estate, with per-connection health, storage topology and provider diagnostics.
Several clouds read as one estate, and a failing connection is visible before it becomes an incident.
Read moreTeam-shared customer-held credentials
Share a storage connection with the team without sharing the cloud key with Rhea. Every member receives their own cryptographic wrap of the connection key, opened only in their browser.
Collaboration no longer forces a choice between a shared secret and a vendor that can read it. Rhea can revoke a member's access, but cannot grant one.
Read moreCustomer-controlled connector execution
In a Zero Custody deployment, a connector inside the customer's own VPC holds every provider credential and decryption key. It verifies scoped authority locally, enforces replay protection locally, and emits signed execution evidence.
Execution verifies authority where it runs, so Rhea coordinates the workflow without being able to perform it alone.
Movement between connected locations
Move protected data between the organization's connected locations within one provider, with checking, transfer, verification and audit handled by Rhea Data.
Storage layout can change without the organization abandoning its protection and evidence model.
A move copies the protected data to the destination and verifies it there. Deletion of the source object is a separate, explicitly authorised operation.
Read moreCross-provider movement
Move protected data between different providers — for example AWS S3 to Azure Blob Storage — as one governed operation.
Changing provider becomes an operation rather than a migration project.
Read moreDatabase connections (BYOD)
Govern relational estates in place under scoped authority, starting with PostgreSQL. The database stays where it is; no migration is required.
Structured data faces the same control problem as documents, and answers to the same authority model.
Rhea Data API and SDK
Interfaces for approved applications to request supported data operations under bounded, expiring authority.
Applications become authorised actors instead of standing exceptions with permanent tokens.
Controlled agent authority
Separate, scoped authority for AI agents and workloads, granted for one operation and one window, never by reusing a person's unrestricted session.
An agent estate needs authority that can be granted narrowly, expires by itself, and can be withdrawn without rotating anything else.
Category
How Rhea Data fits into your stack.
Rhea Data combines data workflows, protection, permissions and recorded activity. These responsibilities explain its role:
- Your connected provider continues to hold the stored data.
- Rhea Data provides the environment for supported data operations.
- Encryption protects file content before storage.
- Rhea Key supports authentication and approvals.
- Your existing identity and security controls still matter.
- In Zero Custody mode, execution credentials and decryption keys never leave your own environment.
Administration
Members, roles and evidence.
Command Center
One operational view of usage, protection state, connections and organizational activity, built from live measurements only.
Leaders see the real state of their data estate, not a decorative dashboard.
Read moreOrganization administration
Manage members and roles, review usage and system health, and configure the organization.
One control surface for the people and settings around protected data.
Read moreAudit and evidence
Review access, approval, administrative and security events, and verify the hash chain over cryptographic events.
The organization can show what happened, not only assert it.
The hash chain covers cryptographic and key-management events. It is not a claim that every record of every type is immutable.
Read moreRhea Data pricing
Unlimited integrations. Usage-based capacity.
Every plan connects as many storage systems, databases, applications and AI agents as you need. Plans differ only in how much you process each month. You never pay for the size of your storage.
Just getting started? Starter
10 GB of data processed and 50,000 operations a month, unlimited connections, applications and AI agents, and a 30-day audit history.
€10/month · Excl. VAT
Choose StarterPro
€60/month
Excl. VAT
- 100 GB data processed / month
- 2 million operations / month
- Unlimited connections
- Unlimited applications & AI agents
- 90-day audit history
- Extra packs from €20
Team
€300/month
Excl. VAT
- 1 TB data processed / month
- 12 million operations / month
- Unlimited connections
- Unlimited applications & AI agents
- 1-year audit history
- Extra packs from €100
Business
€1,500/month
Excl. VAT
- 6 TB data processed / month
- 80 million operations / month
- Unlimited connections
- Unlimited applications & AI agents
- 1-year audit history
- Extra packs from €500
Scale
€7,000/month
Excl. VAT
- 30 TB data processed / month
- 400 million operations / month
- Unlimited connections
- Unlimited applications & AI agents
- 1-year audit history
- Extra packs from €2,000
Enterprise
Dedicated support, a contractual SLA, custom connector work and negotiated terms for large institutions.
Included on every plan
- Unlimited team members
- Unlimited storage and database connections
- Unlimited applications & AI agents
- Free sign-in, approvals and audit viewing
- PDF audit reports
- Audit records are never deleted
How usage is counted
- Data processed
- Bytes that Rhea Data encrypts, decrypts, moves or otherwise handles under a signed grant. Not the size of your storage.
- Operation
- One authority-checked action: Protect, Organise, Authorise, Access, Share, Move, Audit, or the equivalent API call. Database queries, agent tool calls and bulk moves each count as operations.
- All prices exclude VAT.
- Yearly plans are billed upfront at 20% off; allowances reset every month.
- On Pro and above, add a pack in any month and choose any mix of operations and data.
- Your plan sets how far back the in-app audit view reaches. Older history stays downloadable as PDF.
- Subscriptions renew until cancelled. Payments are non-refundable except where required by law.
- Charges from your own storage provider are separate and paid directly to them.
Start inside Rhea Data.
Explore Rhea Data, connect supported customer-owned storage and work through a document workflow. Review permissions and recorded activity in the same environment.