Built to support regulated communication — without pretending every deployment is automatically compliant. We call a framework supported only where it genuinely is.
Letro's architecture supports regulated communication. Actual compliance depends on how a deployment is run — a sovereign data centre or a dedicated server changes the answer, and so does each firm's own governance.
So we map controls case by case instead of printing a badge.
Most rows need both sides. That is why compliance is mapped per deployment, not claimed on a page.
| Framework | Applies to | What it asks for | Where Letro fits |
|---|---|---|---|
| FADP | Switzerland | Lawful processing and real data security under Swiss law. | Swiss hosting and Swiss-bound deployment options. |
| GDPR | EU / EEA | Personal data transfers outside the EEA are restricted. | Region-bound rooms, private deployments, selective federation. |
| DORA | EU finance | Digital resilience against ICT disruption and cyber incidents. | Federated fabric you can host and operate yourself. |
| NIS2 | 18 EU sectors | Cyber risk management, incident reporting, resilience. | Communication brought inside the security perimeter. |
| HIPAA | US health | Cloud is allowed for ePHI — safeguards still apply. | Deployment model and access governance under your control. |
| SEC / FINRA | US finance | Business communications kept as books and records. | Retention and governance answered per deployment. |
| eIDAS | EU documents | Harmonised e-signatures, timestamps and trust services. | Timestamped, tamper-evident document exchange, designed with eIDAS in mind. |
Select a framework for the detail below.
The revised Swiss Federal Act on Data Protection has applied since 1 September 2023. It requires lawful processing, transparency and data security appropriate to the risk.
Letro is hosted in Switzerland with Infomaniak, and every deployment model can be kept Swiss-bound — from the shared cloud to your own infrastructure.
GDPR makes cross-border data movement an architecture question. The EDPB is explicit that transfers of personal data outside the EEA are restricted.
Entities subject to U.S. jurisdiction are generally required to comply with a valid subpoena from a court, grand jury or authorised government body — including for data held overseas, under the CLOUD Act.
Letro supports region-bound rooms, private deployments and selectively federated collaboration instead of forcing every conversation into one global tenant. Your data can reside in Switzerland with a Swiss provider, or in your own infrastructure.
DORA entered into application on 17 January 2025. It is designed to strengthen the digital resilience of banks, insurers, investment firms and other financial entities against ICT disruptions and cyber incidents.
Letro is not a single closed communications silo. It is an open, federated fabric built on Matrix, and the homeserver can be installed and operated by the organisation itself rather than only consumed as a shared vendor service.
Room-level power controls support role separation and controlled administration; identity-provider integration is scoped per deployment.
NIS2 creates a common EU cybersecurity framework across 18 critical sectors and raises expectations around cyber risk management, incident reporting and resilience.
For organisations in or around those sectors, communication tooling is no longer outside the security perimeter. Letro is built to sit inside it — encrypted, deployable on your own terms, and governed like the rest of your stack.
HHS is clear that HIPAA-regulated entities can use cloud products and services for ePHI, but the security and contractual responsibilities still apply.
That makes deployment model, safeguards and access governance central to procurement. In Letro all three are choices you make — cloud, dedicated or sovereign — rather than defaults we impose.
Recordkeeping is a live enforcement issue. In August 2024 the SEC announced more than $390 million in combined settlements in one recordkeeping sweep, and FINRA continues to treat business communications as part of books-and-records obligations.
For this audience, secure communication is not enough on its own. Governance and retention questions matter too, and we work through them with you deployment by deployment.
Where signatures, timestamps or electronic documents are part of the workflow, eIDAS is the key EU reference. The Commission notes that it harmonises e-signatures and trust services across Europe, and that electronic documents cannot be denied legal effect solely for being electronic.
Letro carries hierarchy, access levels, workflows and controlled document handling, so documents stay in the same timestamped, tamper-evident channel as the conversation — designed with eIDAS and QERDS in mind.
Five control areas carry the story. Each one is something a security team can inspect.
Message content is end-to-end encrypted, not merely encrypted in transit.
Cloud, dedicated, sovereign or air-gapped — the residency question is yours to answer.
Hierarchy, access levels and room-level power controls, scoped to how your organisation is structured.
Instructions and approvals move as steps, so the record follows the process.
Controlled document handling with a timestamped, tamper-evident record, in the same channel.
We describe a framework, certification or deployment option as supported only when it is genuinely available in the deployment being discussed.
That keeps the Trust Center useful to security teams and credible to procurement.
Tell us which frameworks matter to your organisation. We map the controls, deployment choices and open questions clearly.