PUBLIC WEBSITE

ReguShield AI · Trust Center

Trust, security & governance

ReguShield AI is European Compliance Intelligence Infrastructure for regulated organisations. This Trust Center sets out how we secure data, respect privacy, govern AI and meet our legal and regulatory commitments. Platform status: Available. There is no public uptime SLA; an enterprise SLA applies only where agreed in signed commercial or order-form terms.

Protection

Security

Technical and organisational measures protecting customer data across the platform.

Encryption

Available

TLS 1.3 in transit, AES-256 at rest.

Tenant isolation

Available

Every workspace is fully isolated and scoped to a single customer.

Access control

Available

Supabase Auth with per-tenant role-based access control.

Immutable audit

Available

Append-only audit trails for compliance and acceptance events.

Secrets management

Available

Server-side secrets only; never shipped to the client bundle.

External penetration test

Planned

Not yet completed. An independent test is planned; no test date is committed.

Full detail: Security Statement → · Identity & Access → · Assurance & ISMS →

Data protection

Privacy

How personal data is processed under the GDPR, including our controller/processor model and sub-processors.

Controller / processor model

Available

We act as processor for workspace data on documented customer instructions.

Data subject rights

Available

Access, rectification, erasure, portability and objection supported.

Data Processing Agreement

Available

GDPR Article 28 DPA available to enterprise customers.

Where data is stored and processed

Stated as four separate facts: some request routing and some sub-processor processing take place outside the EU.

Data storage
Workspace data, authentication data and uploaded files are stored with Supabase in the EU (Frankfurt, Germany · eu-central-1).
Application compute
ReguShield's server-side application functions run on Vercel in the EU (Frankfurt, Germany).
Edge routing
Requests first reach Vercel's global edge network, so a request can be received, TLS-terminated and routed at the edge location nearest the user, which can be outside the EU.
Third-country sub-processors
Some sub-processors can process data outside the EEA (OpenAI for AI reasoning; Resend for transactional email). Such transfers are made under the European Commission's Standard Contractual Clauses with supplementary measures, and each is listed in the sub-processor register.

Sub-processors

Sub-processorSupabase
PurposeManaged PostgreSQL database, authentication and file storage
LocationEU — Frankfurt, Germany (eu-central-1)
Transfer postureStored in the EU
Sub-processorVercel
PurposeApplication compute and edge delivery
LocationFunctions: EU — Frankfurt, Germany · Edge: global network
Transfer postureEdge locations outside the EU can receive and route requests
Sub-processorResend
PurposeTransactional email delivery
LocationEU / US
Transfer postureWhere processed outside the EEA: EU Standard Contractual Clauses with supplementary measures
Sub-processorOpenAI
PurposeAI reasoning for compliance decision-support
LocationUS (outside the EEA)
Transfer postureEU Standard Contractual Clauses with supplementary measures

Full detail: Privacy Policy → · Data Processing Agreement →

Regulatory

Compliance

ReguShield's own organisational posture against European frameworks and security standards. This describes the company, not the product's regulatory coverage for customers, and is not a product gating rule.

GDPR

Available

Controller/processor model, DPA, data-subject rights.

DORA

Planned

ICT risk posture and incident readiness.

AMLA 2027

Planned

Supervisory readiness assessment in product.

AMLR

Planned

Unified CDD and reporting support.

MiCA

Planned

CASP authorisation and Travel Rule support.

EU AI Act

Planned

Explainability, human oversight, FRIA scaffolding.

NIS2

Planned

Network & information security alignment.

eIDAS 2

Planned

Future qualified e-signature integration.

ISO 27001

Planned

Not certified. An ISMS programme is planned; no certification date is committed.

ISO 27701

Planned

Not certified. Privacy information management extension, planned.

SOC 2

Planned

Not certified. Planned; no report or certification date is committed.

Public, source-cited regulatory reference content: Regulatory Horizon →

Responsible AI

AI Governance

ReguShield AI provides compliance decision-support — not legal advice. Our AI governance posture is aligned with the EU AI Act.

Explainability

Available

Deterministic reasoning with regulatory citations and confidence scoring.

Human oversight

Available

Outputs are decision-support inputs; a qualified person reviews before action.

Risk classification

Planned

AI features classified and documented under the EU AI Act.

Bias review & FRIA

Planned

Periodic bias review and Fundamental Rights Impact Assessment scaffolding.

AI Usage Policy → · AI Governance Policy →

Current posture

Trust Status

Review date: 2026-09-30 (product-truth review of trust, residency and company statements).

Data storage in the EU

Available

Workspace data, authentication data and uploaded files are stored with Supabase in Frankfurt, Germany (EU).

Application compute in the EU

Available

Server-side application functions run on Vercel in Frankfurt, Germany (EU). Requests are routed through Vercel's global edge network.

Encryption in transit & at rest

Available

TLS 1.3 in transit, AES-256 at rest.

Tenant isolation

Available

Row-level security scoped per workspace.

Immutable audit trails

Available

Append-only compliance + acceptance audit.

Role-based access control

Available

Per-tenant roles and permissions.

External penetration test

Planned

Planned; not yet completed. No test date is committed.

Public uptime SLA

Not currently available

No public uptime SLA. An enterprise SLA applies only where agreed in signed commercial or order-form terms.

A dedicated environment is available only through a scoped enterprise engagement or onboarding. It is not self-service, not provisioned automatically, and not included merely by opening an Infrastructure account.

Disclosure

Security Contact

Report a security concern or vulnerability. We operate coordinated disclosure.

Email security@regushield.ai (or hello@regushield.ai).

Coordinated disclosure — acknowledge within 72 hours.

Evaluating ReguShield AI for your organisation?

Review the procurement & vendor package, or start enterprise registration.

Procurement Center →Enterprise Registration →

ReguShield AI currently operates in a pre-incorporation phase. ReguShield AI Technology UAB is the planned operating entity in the Republic of Lithuania (EU); it is not yet incorporated. Status labels: Available (in use today) · Planned (not yet in place) · Not currently available.
ReguShield AI provides compliance decision-support intelligence — not legal advice or a regulatory determination.