Registrar Compliance Framework

1. Scope and accountability

This framework applies to RankingAI OÜ's registrar, domain-management, backorder, monitoring and supporting infrastructure activities. Management is accountable for maintaining proportionate legal, contractual, privacy, security, continuity and supplier controls. It is a public control summary, not a claim of certification and not a substitute for a registry's current rules.

2. Registry and legal obligations

We operate registry services only where the required accreditation, agreement or approved arrangement is active.
We maintain registry-specific public information and use the rules in force when a transaction is submitted.
We record the customer's specific instruction and required acceptance before submitting a live registry transaction.
We review public service-status statements, contacts and policy links when an accreditation or production state changes.

3. Registration data and NIS2-related controls

RankingAI maintains procedures for collecting complete and accurate domain registration data, verifying at least one contact method where required, correcting inaccurate data, and responding to lawful and duly substantiated requests for non-public data. The public procedure, request requirements and response channel are set out in our Domain Registration Data Policy.

4. Privacy and data protection

Processing purposes, legal bases, recipients, retention and data-subject rights are documented in our Privacy Policy.
Registry data is shared only as needed for the requested service, registry rules, security, disputes or law.
Access is limited by role and confidentiality obligations; processors and subprocessors are assessed and contractually controlled where required.
Personal-data incidents are triaged, documented and notified to the relevant controller, supervisory authority or affected person within applicable deadlines.

5. Information security

Our security programme uses risk-based access control, strong authentication, least privilege, transport encryption, secrets separation, system hardening, patching, logging, monitoring, protected backups and incident-response procedures. Production registry credentials, private keys, authInfo values and customer evidence are not published on this website or stored in public web paths.

6. Business continuity

RankingAI maintains documented backup, restoration, incident escalation and service-recovery arrangements for critical registrar data and systems. Dependencies and recovery priorities are reviewed when production architecture or registry integrations change. Customer and registry communications are included in incident and continuity procedures.

7. Abuse and security reports

A dedicated and prominently published channel, abuse@rankingai.com, receives DNS abuse and registrar security reports. Reports are logged, risk-triaged, investigated and acted on under our Abuse Handling Policy, the applicable registry agreement and law.

8. Suppliers and third parties

Providers that host, process, transmit or support registrar data are selected according to operational need and risk. Due diligence considers security, privacy, location, continuity, access, incident notification and contractual obligations. Material dependencies are periodically reviewed.

9. Environmental responsibility

RankingAI is a small digital-services company without a dedicated physical data centre. We seek efficient infrastructure sizing, responsible equipment lifecycles, remote-first operations and reputable hosting providers. Environmental claims are kept proportionate and are not presented as audited emissions or certification unless independently verified.

10. Review and reporting

This framework and linked public policies are reviewed after material legal, registry, service or infrastructure changes and at least annually. Questions or compliance concerns may be sent to legal@rankingai.com. Privacy concerns may be sent to privacy@rankingai.com.