White-label RAG for agencies and ESNs: licence, BYOK, deployment at the client

In IgnitionRAG, white-labelling lets you change the colour, the name and the logo from the admin console. Your clients see your brand.

It is sold with the Agency/ESN licence. It is not part of the Solo (€59 excl. VAT/month) and Team (€249 excl. VAT/month) SaaS plans. The licence price is quoted on request.

Source: IgnitionRAG product facts published on ignitionrag.com, October 2026.

Document sources plug in through connectors: web scraping, SharePoint, Azure Tables, Azure Blob, S3 and MinIO, GitHub, Hugging Face.

The first topic in a white-label resale is contractual. Your client hands over documents. You have them processed by a platform. That platform relies on its own providers. Each link has a role under the GDPR.

In the most common setup, your client decides the purposes: it is the controller. Your agency or ESN processes on its behalf: it is a processor. The platform vendor, when it hosts the service, becomes a sub-processor. This qualification must be checked case by case with your DPO: it depends on who decides the purposes and the means.

The European Data Protection Board (EDPB) Guidelines 07/2020 set out two obligations that shape this setup:

1. Prior written authorisation. The processor may not engage another processor without the controller's prior written authorisation, specific or general. With a general authorisation, it must actively inform the controller of any change and give it the opportunity to object (§128).
2. Same obligations down the chain. The contract with the sub-processor must impose the same data protection obligations, including the possibility of audits (§129).

In practice: the platform's provider list must appear in your client contract, and you must be able to announce each change.

An ESN serving ten clients on one platform creates a risk OWASP describes precisely. LLM08:2025 ("Vector and Embedding Weaknesses") lists cross-context information leaks. In a multi-tenant environment where several groups share the same vector database, embeddings from one group may be retrieved in response to another group's queries.

The OWASP "RAG Security Cheat Sheet" gives the countermeasures:

• separate namespaces, collections or indices per tenant;
• filtering enforced at query time, before similarity results are returned;
• cross-tenant test queries, replayed regularly, that must return zero out-of-scope results.

Two architectures meet this need. One instance per client gives the most readable isolation, at the cost of multiplied operations. A multi-organisation platform pools operations, provided isolation is verified for every new client. IgnitionRAG's privacy policy describes multi-tenant data isolation per organisation. Still replay your own test queries between two organisations before onboarding a second client: OWASP recommends it, and it is your responsibility as a processor.

BYOK means "bring your own keys": calls to the language model use API keys that belong to the agency or its client.

In IgnitionRAG, BYOK is available with a licence and does not exist on SaaS. The Solo and Team SaaS plans run on platform-managed AI with credits included: no key to provide. BYOK also exists at other vendors. The choice mostly comes down to three points:

With the end client's keys, the model invoice and contract stay with the client. With the ESN's keys, you carry that cost and re-bill it.

The Agency/ESN licence deploys on the client's infrastructure (Azure, AWS or Google Cloud) or with IgnitionAI.

Our guide France-hosted RAG details the questions on applicable law and model location to ask for each option.

Grid basis: EDPB Guidelines 07/2020 and the OWASP publications cited below. Mapping situations to approaches is our reading and is not legal advice.

1. A processing agreement listing sub-processors and the notification procedure for changes.
2. The deployment location, client by client.
3. The account holding the model keys, and the re-billing rule.
4. A set of test queries between two organisations, replayed for every new client.
5. A withdrawal procedure: what happens to documents, index and traces when a client leaves?

Regulatory sources

• Regulation (EU) 2016/679 of 27 April 2016 (GDPR), Article 28 (EUR-Lex). Consulted on 22 October 2026.
• EDPB, Guidelines 07/2020 on the concepts of controller and processor in the GDPR, version 2.0 adopted on 7 July 2021, §128 and §129 (GDPR Article 28). Consulted on 22 October 2026.

Technical sources

• OWASP, LLM08:2025 Vector and Embedding Weaknesses, scenario 2. Consulted on 22 October 2026.
• OWASP, RAG Security Cheat Sheet, sections 6 and 12. Consulted on 22 October 2026.
• IgnitionRAG privacy policy and pricing page. Consulted on 22 October 2026.

IgnitionAI estimates

None. The Agency/ESN licence price is quoted on request.

Limits

This guide does not legally qualify your setup. Controller and processor roles are determined case by case, with your DPO.

Last source review

22 October 2026.

To scope an Agency/ESN licence (white label, BYOK, deployment location), contact us from the pricing page. The SaaS trial includes 14 days and 100 credits, without a payment card.