PUBLIC WEBSITE

Procurement & Vendor Trust Package

Procurement Center

Everything a European enterprise security, legal and procurement review needs — security and architecture overviews, sub-processors, retention, shared responsibility, a pre-answered security questionnaire, incident response, BCP, AI governance, roadmap, audit calendar and a vendor risk register — plus a one-click Trust Package.

Legal Entity

ReguShield AI Technology UAB (planned — not yet incorporated) — Planned private limited liability company (uždaroji akcinė bendrovė) — incorporation planned Q3 2026

Jurisdiction · Data Residency

Lithuania (EU member state) — incorporation planned Q3 2026; currently pre-incorporation · European Union

Contacts

hello@regushield.ai · security@regushield.ai · privacy@regushield.ai

Website

https://www.regushield.ai

Download Center

Board-grade PDF packages, or the consolidated Markdown pack.

Index

Procurement Document Index

Every artifact in this package, with links to the published legal documents.

Full Trust Package ⤓

Consolidated security, legal and procurement pack.

Security Overview

Technical & organisational measures.

Architecture Overview

Hosting, data, auth, AI, email layers.

Sub-processor Registry

Named sub-processors + purpose + location.

Retention Matrix

Data categories, retention, basis.

Shared Responsibility Matrix

ReguShield vs Customer responsibilities.

Security Questionnaire (SIG/CAIQ-style)

Pre-answered diligence questionnaire.

Incident Response Summary

Detection, notification, disclosure.

BCP / Resilience Summary

Backups & recovery posture.

AI Governance Statement ↗

EU AI Act-aligned posture.

Data Processing Agreement (v1) ↗

GDPR Article 28 DPA.

Enterprise Agreement (v1) ↗

Master enterprise subscription terms.

Pilot Agreement (v1) ↗

Time-boxed evaluation terms.

GDPR privacy notice.

Platform master terms.

Acceptable Use Policy ↗

Permitted/prohibited use.

Trust Roadmap

Implemented / Planned / Roadmap.

Audit Calendar

Upcoming assurance milestones.

Vendor Risk Register

Risks + mitigations.

Security

Security Overview

Technical and organisational measures. Maturity labelled Implemented / Planned / Roadmap.

Encryption in transit

Implemented

TLS 1.3 for all client and API traffic.

Encryption at rest

Implemented

AES-256 at rest on managed EU infrastructure.

Tenant isolation

Implemented

PostgreSQL row-level security keyed to the verified workspace-owner email; one email = one isolated workspace.

Authentication

Implemented

Supabase Auth (email/password); session-scoped access.

Role-based access control

Implemented

Per-workspace roles (Owner, Compliance Officer, Risk, Auditor, Viewer) with a permission matrix.

Immutable audit trails

Implemented

Append-only compliance and agreement-acceptance audit; acceptance audit is permanent and tamper-evident (hashed).

Secrets management

Implemented

Server-side secrets only; never shipped to the client bundle.

Coordinated vulnerability disclosure

Implemented

Report to security@regushield.ai; acknowledgement target 72 hours.

External penetration test

Planned

Independent assessment targeted for Q3 2026.

Information Security Management System (ISO 27001)

Roadmap

Formal ISMS programme — not yet certified.

Architecture

Architecture Overview

Layer	Detail
Application	Next.js (App Router) / React, server-rendered; hosted on Vercel (EU / edge).
Database	Managed PostgreSQL via Supabase, EU region; row-level security enforces tenant isolation.
Authentication	Supabase Auth; JWT session; access scoped by verified email.
AI reasoning	OpenAI API for AI-assisted reasoning under contractual terms + Standard Contractual Clauses (US transfer); customer data is not used to train provider foundation models.
Transactional email	Resend for activation and lifecycle email (EU/US).
Data flow	Customer uploads operational/compliance data → processed in the EU workspace → AI/deterministic analysis → audit-ready reporting. No third-party data sharing beyond the named sub-processors.

LayerApplication

DetailNext.js (App Router) / React, server-rendered; hosted on Vercel (EU / edge).

LayerDatabase

DetailManaged PostgreSQL via Supabase, EU region; row-level security enforces tenant isolation.

LayerAuthentication

DetailSupabase Auth; JWT session; access scoped by verified email.

LayerAI reasoning

DetailOpenAI API for AI-assisted reasoning under contractual terms + Standard Contractual Clauses (US transfer); customer data is not used to train provider foundation models.

LayerTransactional email

DetailResend for activation and lifecycle email (EU/US).

LayerData flow

DetailCustomer uploads operational/compliance data → processed in the EU workspace → AI/deterministic analysis → audit-ready reporting. No third-party data sharing beyond the named sub-processors.

Vendors

Sub-processor Registry

GDPR Article 28(2) named sub-processors.

Sub-processor	Purpose	Location	Category
Supabase	Managed PostgreSQL database & authentication	EU	Infrastructure
Vercel	Application hosting & edge delivery	EU / Global edge	Infrastructure
Resend	Transactional email delivery	EU / US	Communications
OpenAI	AI reasoning for compliance decision-support	US	AI processing

Sub-processorSupabase

PurposeManaged PostgreSQL database & authentication

LocationEU

CategoryInfrastructure

Sub-processorVercel

PurposeApplication hosting & edge delivery

LocationEU / Global edge

CategoryInfrastructure

Sub-processorResend

PurposeTransactional email delivery

LocationEU / US

CategoryCommunications

Sub-processorOpenAI

PurposeAI reasoning for compliance decision-support

LocationUS

CategoryAI processing

Data

Retention Matrix

Data Category	Retention	Basis
Customer workspace data	365 days (default, configurable per tenant)	Contract / legitimate interest
Security & compliance audit logs	~7 years	Legal obligation / accountability
Governance acceptance audit	Permanent (legal record — never auto-deleted)	Evidence of agreement acceptance
Pilot evaluation data	90 days	Pilot agreement
Account & identity data	Duration of the contract + statutory minimums	Contract / legal obligation
Backups	Per managed-infrastructure backup policy	Resilience

Data CategoryCustomer workspace data

Retention365 days (default, configurable per tenant)

BasisContract / legitimate interest

Data CategorySecurity & compliance audit logs

Retention~7 years

BasisLegal obligation / accountability

Data CategoryGovernance acceptance audit

RetentionPermanent (legal record — never auto-deleted)

BasisEvidence of agreement acceptance

Data CategoryPilot evaluation data

Retention90 days

BasisPilot agreement

Data CategoryAccount & identity data

RetentionDuration of the contract + statutory minimums

BasisContract / legal obligation

Data CategoryBackups

RetentionPer managed-infrastructure backup policy

BasisResilience

Model

Shared Responsibility Matrix

Area	ReguShield	Customer
Platform security (infra, encryption, isolation)	Owns	—
Availability of the managed service	Owns	—
Backups & infrastructure resilience	Owns	Verify exports for critical records
Lawful basis for uploaded personal data	Processor (acts on instructions)	Controller — owns lawful basis
Accuracy of uploaded data	—	Owns
User & role administration within the workspace	Provides controls	Owns day-to-day administration
Human oversight of AI-assisted outputs	Builds oversight controls	Owns the final regulated decision
Regulatory filings (STR, CDD, supervisory submissions)	—	Owns
Incident notification to data subjects / authorities	Notifies Customer without undue delay	Owns controller notification duties

AreaPlatform security (infra, encryption, isolation)

ReguShieldOwns

Customer—

AreaAvailability of the managed service

ReguShieldOwns

Customer—

AreaBackups & infrastructure resilience

ReguShieldOwns

CustomerVerify exports for critical records

AreaLawful basis for uploaded personal data

ReguShieldProcessor (acts on instructions)

CustomerController — owns lawful basis

AreaAccuracy of uploaded data

ReguShield—

CustomerOwns

AreaUser & role administration within the workspace

ReguShieldProvides controls

CustomerOwns day-to-day administration

AreaHuman oversight of AI-assisted outputs

ReguShieldBuilds oversight controls

CustomerOwns the final regulated decision

AreaRegulatory filings (STR, CDD, supervisory submissions)

ReguShield—

CustomerOwns

AreaIncident notification to data subjects / authorities

ReguShieldNotifies Customer without undue delay

CustomerOwns controller notification duties

Diligence

Security Questionnaire

Pre-answered SIG / CAIQ-style questionnaire — honest, including what is not yet certified.

Data Protection

Where is customer data stored?

In the European Union (managed PostgreSQL via Supabase, EU region).

Data Protection

Is data encrypted in transit and at rest?

Yes — TLS 1.3 in transit, AES-256 at rest.

Data Protection

Is there a Data Processing Agreement?

Yes — a GDPR Article 28 DPA is available (see Legal Agreements).

Access Control

How is tenant data isolated?

PostgreSQL row-level security keyed to the verified workspace-owner email; one email = one isolated workspace.

Access Control

Is role-based access control supported?

Yes — five workspace roles with a documented permission matrix.

Access Control

How are administrative secrets handled?

Server-side only; never exposed to the client bundle.

Infrastructure

Who are your sub-processors?

Supabase, Vercel, Resend, OpenAI — see the Sub-processor Registry.

Infrastructure

Do you transfer data outside the EEA?

Workspace data is hosted in the EU. Where a sub-processor (e.g. OpenAI) processes data in the US, transfers are made under EU Standard Contractual Clauses with supplementary measures.

Incident Response

Do you have an incident response process?

Yes — detection, triage, customer notification without undue delay, and coordinated disclosure (see Incident Response Summary).

Incident Response

How are vulnerabilities reported?

Coordinated disclosure to security@regushield.ai; acknowledgement target 72 hours.

Resilience

Are backups performed?

Yes — managed database backups via the infrastructure provider. A formal BCP/DR with tested RTO/RPO is Planned.

AI Governance

Is the AI making autonomous regulated decisions?

No. The platform is decision-support; a qualified person makes the final decision, with mandated human oversight (EU AI Act Art. 14).

AI Governance

Is customer data used to train your AI models?

No. Customer data is processed to generate the customer's own analysis; it is not used to train provider foundation models.

Certifications

Are you ISO 27001 / ISO 27701 / SOC 2 certified?

No — these are Roadmap items and are not yet certified. We disclose this transparently; an ISMS programme and an independent penetration test are in progress/planned.

Certifications

Which regulations does the platform support?

AMLA 2027, AMLR, MiCA, DORA, EU AI Act, Travel Rule and GDPR (as decision-support; not a regulatory determination).

Resilience

Incident Response Summary

Detection: Monitoring of platform and infrastructure signals; reports via the security contact.
Triage: Severity assessment and scoping by the security contact on a coordinated-disclosure basis.
Customer notification: Affected customers are notified without undue delay after we become aware of a personal-data breach affecting their data, with the information reasonably available to support their own notification duties.
Authority context: As processor, ReguShield assists the Customer (controller), who owns the GDPR 72-hour authority-notification obligation.
Disclosure: Coordinated disclosure via security@regushield.ai; acknowledgement target 72 hours.

Resilience

Business Continuity / Resilience

backups

Implemented

Managed database backups via the infrastructure provider (Supabase).

recovery

Planned

A formal business-continuity and disaster-recovery plan with tested recovery objectives (RTO/RPO) is being documented.

redundancy

Implemented

Managed cloud infrastructure with provider-level redundancy.

Responsible AI

AI Governance Statement

Decision-support, not autonomous regulated decisioning. EU AI Act-aligned.

Nature: Decision-support — informs but does not replace qualified compliance judgement.
Human oversight: Mandated human oversight; outputs are reviewed before any regulated action (EU AI Act Art. 14).
Explainability: Deterministic rule logic with regulatory citations and confidence indicators.
Classification: Formal EU AI Act classification and, where applicable, a Fundamental Rights Impact Assessment are being prepared (Planned).
Data use: Customer data is not used to train provider foundation models.

Full AI Governance Policy →

Assurance

Trust Roadmap

What is live today and what is planned — including certifications NOT yet held.

EU data residency & tenant isolation (RLS) · LiveImplemented

GDPR DPA, sub-processor register, data-subject rights · LiveImplemented

Immutable acceptance audit & policy versioning · LiveImplemented

External penetration test · Q3 2026Planned

DORA ICT risk mapping · 2026Planned

EU AI Act classification / FRIA scaffolding · 2026Planned

ISO/IEC 27001 (ISMS) certification · Not yet certifiedRoadmap

ISO/IEC 27701 (privacy) certification · Not yet certifiedRoadmap

SOC 2 (Type I → II) · Not yet certifiedRoadmap

Qualified e-signature (eIDAS 2) on agreements · FutureRoadmap

Assurance

Audit Calendar

Activity	Type	Status	Window
External penetration test	Security assessment	Planned	Q3 2026
ISMS gap assessment (ISO 27001)	Assurance	Roadmap	TBC
Sub-processor due-diligence review	Vendor risk	Planned	Annual
Policy & DPA review	Legal/governance	Planned	Annual / on change
Access & RLS control review	Security	Planned	Periodic

ActivityExternal penetration test

TypeSecurity assessment

StatusPlanned

WindowQ3 2026

ActivityISMS gap assessment (ISO 27001)

TypeAssurance

StatusRoadmap

WindowTBC

ActivitySub-processor due-diligence review

TypeVendor risk

StatusPlanned

WindowAnnual

ActivityPolicy & DPA review

TypeLegal/governance

StatusPlanned

WindowAnnual / on change

ActivityAccess & RLS control review

TypeSecurity

StatusPlanned

WindowPeriodic

Vendor Risk

Vendor Risk Register

Procurement-relevant risks with mitigations — transparently disclosed.

Risk	Impact	Mitigation	Status
No third-party security certification yet (ISO 27001 / SOC 2)	Medium (procurement gating)	Transparent disclosure; ISMS programme + external pentest planned; DPA + technical measures available now.	Open
AI sub-processor processes data in the US (OpenAI)	Medium	EU Standard Contractual Clauses + supplementary measures; no model training on customer data; EU-inference option under evaluation.	Mitigated
Sub-processor concentration (managed cloud)	Medium	Named register, due-diligence review, exit-readiness documentation (DORA-aligned, planned).	Monitored
Formal BCP/DR not yet documented with tested RTO/RPO	Medium	Managed backups in place today; formal BCP/DR planned.	Open
Legal documents pending qualified-counsel sign-off	Low/Medium	Framework content published transparently; counsel review before external binding.	Open

RiskNo third-party security certification yet (ISO 27001 / SOC 2)

ImpactMedium (procurement gating)

MitigationTransparent disclosure; ISMS programme + external pentest planned; DPA + technical measures available now.

StatusOpen

RiskAI sub-processor processes data in the US (OpenAI)

ImpactMedium

MitigationEU Standard Contractual Clauses + supplementary measures; no model training on customer data; EU-inference option under evaluation.

StatusMitigated

RiskSub-processor concentration (managed cloud)

ImpactMedium

MitigationNamed register, due-diligence review, exit-readiness documentation (DORA-aligned, planned).

StatusMonitored

RiskFormal BCP/DR not yet documented with tested RTO/RPO

ImpactMedium

MitigationManaged backups in place today; formal BCP/DR planned.

StatusOpen

RiskLegal documents pending qualified-counsel sign-off

ImpactLow/Medium

MitigationFramework content published transparently; counsel review before external binding.

StatusOpen

ReguShield AI Technology UAB (planned — not yet incorporated) · Lithuania (EU member state) — incorporation planned Q3 2026; currently pre-incorporation. ReguShield AI provides compliance decision-support intelligence — not legal advice or a regulatory determination. Maturity labels: Implemented (live) · Planned (in progress) · Roadmap (intended, not yet in place).