Early-stage EU SaaS teams that already use an AI coding agent. No compliance officer or lawyer needed to start.

We are not registered in Estonia. Does this still work?

Yes. EU-wide law reaches you in every member state. National law is added country by country; Estonia is live today. Full list on the coverage page.

What does Rilvo produce, and what stays with my team?

Which rules apply to you, the policies they require, and the procedures behind them. Technical controls are specified with the evidence they need; wiring them into your product stays with your engineers. The four layers are defined in the Docs glossary.

We were asked for SOC 2. Does Rilvo give us that?

No. SOC 2 and ISO 27001 are certifications an auditor issues, and Rilvo does not issue them. It answers the question underneath: which rules actually bind your company. You do not have to pick a framework first.

Where do our files and data go?

Your answers, research notes and evidence files stay on your machine. The Rilvo server receives the verdicts, their act citations, your decisions on gray areas, and a SHA-256 hash of each evidence file. The full boundary is in the Docs.

Is this legal advice?

Rilvo produces legal analysis. It is not legal advice and creates no lawyer-client relationship. Every verdict cites the act behind it, so your own counsel can check the reasoning.

Four people, and the founder takes every demo call himself. Who we are.

Know which EU rules reach you

Rilvo is an MCP server for the coding agent your EU SaaS team already uses. One command, and it drafts the paperwork those rules require.

Book a demo

30-min call with founder

Overall health score
across 9 active domains

works with Claude Code, Codex, Cursor

the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned has given his or her consent → cookie-consent.md each controller and, where applicable, the controller’s representative, shall maintain a record of processing activities under its responsibility → records-of-processing.md personal data shall be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed → data-minimisation.md providers shall ensure that ai systems intended to interact directly with natural persons are designed and developed in such a way that the natural persons concerned are informed that they are interacting with an ai system → ai-disclosure.md in the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority → breach-procedure.md the place of supply of electronically supplied services to a non-taxable person shall be the place where that person is established → oss-registration.md where processing is to be carried out on behalf of a controller, the controller shall use only processors providing sufficient guarantees to implement appropriate technical and organisational measures → dpa-register.md the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned has given his or her consent → cookie-consent.md each controller and, where applicable, the controller’s representative, shall maintain a record of processing activities under its responsibility → records-of-processing.md personal data shall be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed → data-minimisation.md providers shall ensure that ai systems intended to interact directly with natural persons are designed and developed in such a way that the natural persons concerned are informed that they are interacting with an ai system → ai-disclosure.md in the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority → breach-procedure.md the place of supply of electronically supplied services to a non-taxable person shall be the place where that person is established → oss-registration.md where processing is to be carried out on behalf of a controller, the controller shall use only processors providing sufficient guarantees to implement appropriate technical and organisational measures → dpa-register.md

Where you stand, sample data

GDPR2 gaps
VAT / OSS2 gaps
AI Act1 gap

Someone will ask which rules reach you, and finding out takes about an hour

A customer sends a security questionnaire
Forty questions, two weeks, one person's head
An investor opens due diligence
“We think none of them” does not survive the follow-up
A regulator writes first
By then the paperwork has to already exist

What happens when you connect it

Your terminal
claude mcp add --transport http rilvo https://mcp.rilvo.io/mcp
Your files stay on your machine
Your agent works out which rules reach you, and every verdict cites the act
L2In placePolicies
L3In progressProcedures
L4GapControls
Sample data
The paperwork those rules require, and what is still open

What you show when they ask

100%Onboarding complete

FoundGDPRVAT / OSSAI Actand 6 more

Business profileMapped

Applicable laws9 domains found

Sanctions screeningIncluded

Framework choiceNot required yet

Sample data

Open a domain and the work is already there

GDPR

First cycle2 gaps1 of 3 requirements met

Privacy policy approved and published
Drafted against your findings, signed off
In place
Data subject request procedure written down
Who answers, within what deadline, and where it is logged
In progress
Consent recorded in the product
Control specified, evidence not yet collected
Gap

Sample data

Acts checked

Areas of law

EU-wide law, plus national law where we have it: Estonia today, marked EE

Data protection and privacy
- GDPR
- ePrivacy Directive
- Personal Data Protection Act (EE)
Data governance and AI
- Data Act
- Data Governance Act
- AI Act
Cybersecurity and resilience
- CRA
- EU Cybersecurity Act
- DORA
- Cybersecurity Act (EE)

All 47 acts

Questions we get

Who is Rilvo for?
Early-stage EU SaaS teams that already use an AI coding agent. No compliance officer or lawyer needed to start.
We are not registered in Estonia. Does this still work?
Yes. EU-wide law reaches you in every member state. National law is added country by country; Estonia is live today. Full list on the coverage page.
What does Rilvo produce, and what stays with my team?
Which rules apply to you, the policies they require, and the procedures behind them. Technical controls are specified with the evidence they need; wiring them into your product stays with your engineers. The four layers are defined in the Docs glossary.
We were asked for SOC 2. Does Rilvo give us that?
No. SOC 2 and ISO 27001 are certifications an auditor issues, and Rilvo does not issue them. It answers the question underneath: which rules actually bind your company. You do not have to pick a framework first.
Where do our files and data go?
Your answers, research notes and evidence files stay on your machine. The Rilvo server receives the verdicts, their act citations, your decisions on gray areas, and a SHA-256 hash of each evidence file. The full boundary is in the Docs.
Is this legal advice?
Rilvo produces legal analysis. It is not legal advice and creates no lawyer-client relationship. Every verdict cites the act behind it, so your own counsel can check the reasoning.
Who is behind Rilvo?
Four people, and the founder takes every demo call himself. Who we are.

Know which EU rules reach you

Someone will ask which rules reach you, and finding out takes about an hour

What happens when you connect it

What you show when they ask

Open a domain and the work is already there

Every act we check, by area of law

Data protection and privacy

Data governance and AI

Cybersecurity and resilience

Questions we get

Who is Rilvo for?

We are not registered in Estonia. Does this still work?

What does Rilvo produce, and what stays with my team?

We were asked for SOC 2. Does Rilvo give us that?

Where do our files and data go?

Is this legal advice?

Who is behind Rilvo?

A note when there is something new to show