PUBLIC WEBSITE

Procurement & Vendor Trust Package

Procurement Center

Everything a European enterprise security, legal and procurement review needs — security and architecture overviews, sub-processors, retention, shared responsibility, a pre-answered security questionnaire, incident response, BCP, AI governance, roadmap, audit calendar and a vendor risk register — plus a one-click Trust Package.

Legal Entity

ReguShield AI Technology UAB (planned — not yet incorporated) — Planned private limited liability company (uždaroji akcinė bendrovė); ReguShield AI currently operates in a pre-incorporation phase

Jurisdiction · Data Residency

Lithuania (EU member state), planned; Vilnius is the planned headquarters · Data stored in the EU (Frankfurt) · application compute in the EU (Frankfurt) · global edge routing · non-EEA sub-processors disclosed separately

Contacts

hello@regushield.ai · security@regushield.ai · privacy@regushield.ai

Website

https://www.regushield.ai

Download Center

Board-grade PDF packages, or the consolidated Markdown pack.

Index

Procurement Document Index

Every artifact in this package, with links to the published legal documents.

Full Trust Package ⤓

Consolidated security, legal and procurement pack.

Security Overview

Technical & organisational measures.

Architecture Overview

Hosting, data, auth, AI, email layers.

Sub-processor Registry

Named sub-processors + purpose + location.

Retention Matrix

Data categories, retention, basis.

Shared Responsibility Matrix

ReguShield vs Customer responsibilities.

Security Questionnaire (SIG/CAIQ-style)

Pre-answered diligence questionnaire.

Incident Response Summary

Detection, notification, disclosure.

BCP / Resilience Summary

Backups & recovery posture.

AI Governance Statement ↗

EU AI Act-aligned posture.

Data Processing Agreement (v1) ↗

GDPR Article 28 DPA.

Enterprise Agreement (v1) ↗

Master enterprise subscription terms.

Pilot Agreement (v1) ↗

Time-boxed evaluation terms.

GDPR privacy notice.

Platform master terms.

Acceptable Use Policy ↗

Permitted/prohibited use.

Trust Roadmap

What is available today and what is planned.

Audit Calendar

Upcoming assurance milestones.

Vendor Risk Register

Risks + mitigations.

Security

Security Overview

Technical and organisational measures, each with its current status.

Encryption in transit

Available

TLS 1.3 for all client and API traffic.

Encryption at rest

Available

AES-256 at rest on the managed database and file storage (Supabase, EU).

Tenant isolation

Available

PostgreSQL row-level security keyed to the verified workspace-owner email; one email = one isolated workspace.

Authentication

Available

Supabase Auth (email/password); session-scoped access.

Role-based access control

Available

Per-workspace roles (Owner, Compliance Officer, Risk, Auditor, Viewer) with a permission matrix.

Immutable audit trails

Available

Append-only compliance and agreement-acceptance audit; acceptance audit is permanent and tamper-evident (hashed).

Secrets management

Available

Server-side secrets only; never shipped to the client bundle.

Coordinated vulnerability disclosure

Available

Report to security@regushield.ai; acknowledgement target 72 hours.

External penetration test

Planned

Planned; not yet completed. No test date is committed.

Information Security Management System (ISO 27001)

Planned

Not certified. A formal ISMS programme is planned.

Architecture

Architecture Overview

Hosting and data location are stated as four separate facts.

Data storage: Workspace data, authentication data and uploaded files are stored with Supabase in the EU (Frankfurt, Germany · eu-central-1).
Application compute: ReguShield's server-side application functions run on Vercel in the EU (Frankfurt, Germany).
Edge routing: Requests first reach Vercel's global edge network, so a request can be received, TLS-terminated and routed at the edge location nearest the user, which can be outside the EU.
Third-country sub-processors: Some sub-processors can process data outside the EEA (OpenAI for AI reasoning; Resend for transactional email). Such transfers are made under the European Commission's Standard Contractual Clauses with supplementary measures, and each is listed in the sub-processor register.

Layer	Detail
Application compute	Next.js (App Router) / React, server-rendered on Vercel. ReguShield's server-side application functions run on Vercel in the EU (Frankfurt, Germany). (Vercel Functions region fra1.)
Edge routing	Requests first reach Vercel's global edge network, so a request can be received, TLS-terminated and routed at the edge location nearest the user, which can be outside the EU.
Database & file storage	Workspace data, authentication data and uploaded files are stored with Supabase in the EU (Frankfurt, Germany · eu-central-1). Row-level security enforces tenant isolation.
Authentication	Supabase Auth; JWT session; access scoped by verified email.
AI reasoning	OpenAI API for AI-assisted reasoning under contractual terms + Standard Contractual Clauses (US transfer); customer data is not used to train provider foundation models.
Transactional email	Resend for activation and lifecycle email (EU/US).
Data flow	Customer uploads operational/compliance data → stored in the EU workspace (Frankfurt) → deterministic analysis on EU application compute, and AI-assisted reasoning via OpenAI (US) where used → audit-ready reporting. No third-party data sharing beyond the named sub-processors.

LayerApplication compute

DetailNext.js (App Router) / React, server-rendered on Vercel. ReguShield's server-side application functions run on Vercel in the EU (Frankfurt, Germany). (Vercel Functions region fra1.)

LayerEdge routing

DetailRequests first reach Vercel's global edge network, so a request can be received, TLS-terminated and routed at the edge location nearest the user, which can be outside the EU.

LayerDatabase & file storage

DetailWorkspace data, authentication data and uploaded files are stored with Supabase in the EU (Frankfurt, Germany · eu-central-1). Row-level security enforces tenant isolation.

LayerAuthentication

DetailSupabase Auth; JWT session; access scoped by verified email.

LayerAI reasoning

DetailOpenAI API for AI-assisted reasoning under contractual terms + Standard Contractual Clauses (US transfer); customer data is not used to train provider foundation models.

LayerTransactional email

DetailResend for activation and lifecycle email (EU/US).

LayerData flow

DetailCustomer uploads operational/compliance data → stored in the EU workspace (Frankfurt) → deterministic analysis on EU application compute, and AI-assisted reasoning via OpenAI (US) where used → audit-ready reporting. No third-party data sharing beyond the named sub-processors.

Vendors

Sub-processor Registry

GDPR Article 28(2) named sub-processors.

Sub-processor	Purpose	Location	Transfer posture	Category
Supabase	Managed PostgreSQL database, authentication and file storage	EU — Frankfurt, Germany (eu-central-1)	Stored in the EU	Infrastructure
Vercel	Application compute and edge delivery	Functions: EU — Frankfurt, Germany · Edge: global network	Edge locations outside the EU can receive and route requests	Infrastructure
Resend	Transactional email delivery	EU / US	Where processed outside the EEA: EU Standard Contractual Clauses with supplementary measures	Communications
OpenAI	AI reasoning for compliance decision-support	US (outside the EEA)	EU Standard Contractual Clauses with supplementary measures	AI processing

Sub-processorSupabase

PurposeManaged PostgreSQL database, authentication and file storage

LocationEU — Frankfurt, Germany (eu-central-1)

Transfer postureStored in the EU

CategoryInfrastructure

Sub-processorVercel

PurposeApplication compute and edge delivery

LocationFunctions: EU — Frankfurt, Germany · Edge: global network

Transfer postureEdge locations outside the EU can receive and route requests

CategoryInfrastructure

Sub-processorResend

PurposeTransactional email delivery

LocationEU / US

Transfer postureWhere processed outside the EEA: EU Standard Contractual Clauses with supplementary measures

CategoryCommunications

Sub-processorOpenAI

PurposeAI reasoning for compliance decision-support

LocationUS (outside the EEA)

Transfer postureEU Standard Contractual Clauses with supplementary measures

CategoryAI processing

Data

Retention Matrix

Data Category	Retention	Basis
Customer workspace data	365 days (default, configurable per tenant)	Contract / legitimate interest
Security & compliance audit logs	~7 years	Legal obligation / accountability
Governance acceptance audit	Permanent (legal record — never auto-deleted)	Evidence of agreement acceptance
Pilot evaluation data	90 days	Pilot agreement
Account & identity data	Duration of the contract + statutory minimums	Contract / legal obligation
Backups	Per managed-infrastructure backup policy	Resilience

Data CategoryCustomer workspace data

Retention365 days (default, configurable per tenant)

BasisContract / legitimate interest

Data CategorySecurity & compliance audit logs

Retention~7 years

BasisLegal obligation / accountability

Data CategoryGovernance acceptance audit

RetentionPermanent (legal record — never auto-deleted)

BasisEvidence of agreement acceptance

Data CategoryPilot evaluation data

Retention90 days

BasisPilot agreement

Data CategoryAccount & identity data

RetentionDuration of the contract + statutory minimums

BasisContract / legal obligation

Data CategoryBackups

RetentionPer managed-infrastructure backup policy

BasisResilience

Model

Shared Responsibility Matrix

Area	ReguShield	Customer
Platform security (infra, encryption, isolation)	Owns	—
Availability of the managed service	Owns	—
Backups & infrastructure resilience	Owns	Verify exports for critical records
Lawful basis for uploaded personal data	Processor (acts on instructions)	Controller — owns lawful basis
Accuracy of uploaded data	—	Owns
User & role administration within the workspace	Provides controls	Owns day-to-day administration
Human oversight of AI-assisted outputs	Builds oversight controls	Owns the final regulated decision
Regulatory filings (STR, CDD, supervisory submissions)	—	Owns
Incident notification to data subjects / authorities	Notifies Customer without undue delay	Owns controller notification duties

AreaPlatform security (infra, encryption, isolation)

ReguShieldOwns

Customer—

AreaAvailability of the managed service

ReguShieldOwns

Customer—

AreaBackups & infrastructure resilience

ReguShieldOwns

CustomerVerify exports for critical records

AreaLawful basis for uploaded personal data

ReguShieldProcessor (acts on instructions)

CustomerController — owns lawful basis

AreaAccuracy of uploaded data

ReguShield—

CustomerOwns

AreaUser & role administration within the workspace

ReguShieldProvides controls

CustomerOwns day-to-day administration

AreaHuman oversight of AI-assisted outputs

ReguShieldBuilds oversight controls

CustomerOwns the final regulated decision

AreaRegulatory filings (STR, CDD, supervisory submissions)

ReguShield—

CustomerOwns

AreaIncident notification to data subjects / authorities

ReguShieldNotifies Customer without undue delay

CustomerOwns controller notification duties

Diligence

Security Questionnaire

Pre-answered SIG / CAIQ-style questionnaire — honest, including what is not yet certified.

Data Protection

Where is customer data stored?

Workspace data, authentication data and uploaded files are stored with Supabase in the EU (Frankfurt, Germany · eu-central-1). ReguShield's server-side application functions run on Vercel in the EU (Frankfurt, Germany). Requests first reach Vercel's global edge network, so a request can be received, TLS-terminated and routed at the edge location nearest the user, which can be outside the EU.

Data Protection

Is data encrypted in transit and at rest?

Yes — TLS 1.3 in transit, AES-256 at rest.

Data Protection

Is there a Data Processing Agreement?

Yes — a GDPR Article 28 DPA is available (see Legal Agreements).

Access Control

How is tenant data isolated?

PostgreSQL row-level security keyed to the verified workspace-owner email; one email = one isolated workspace.

Access Control

Is role-based access control supported?

Yes — five workspace roles with a documented permission matrix.

Access Control

How are administrative secrets handled?

Server-side only; never exposed to the client bundle.

Infrastructure

Who are your sub-processors?

Supabase, Vercel, Resend, OpenAI — see the Sub-processor Registry.

Infrastructure

Do you transfer data outside the EEA?

Yes, for named sub-processors. Some sub-processors can process data outside the EEA (OpenAI for AI reasoning; Resend for transactional email). Such transfers are made under the European Commission's Standard Contractual Clauses with supplementary measures, and each is listed in the sub-processor register. Stored workspace data remains in the EU (Frankfurt).

Incident Response

Do you have an incident response process?

Yes — detection, triage, customer notification without undue delay, and coordinated disclosure (see Incident Response Summary).

Incident Response

How are vulnerabilities reported?

Coordinated disclosure to security@regushield.ai; acknowledgement target 72 hours.

Resilience

Are backups performed?

Yes — managed database backups via the infrastructure provider. A formal BCP/DR with tested RTO/RPO is Planned.

AI Governance

Is the AI making autonomous regulated decisions?

No. The platform is decision-support; a qualified person makes the final decision, with mandated human oversight (EU AI Act Art. 14).

AI Governance

Is customer data used to train your AI models?

No. Customer data is processed to generate the customer's own analysis; it is not used to train provider foundation models.

Certifications

Are you ISO 27001 / ISO 27701 / SOC 2 certified?

No — ReguShield is not yet certified to ISO 27001, ISO 27701 or SOC 2; these are planned (Roadmap) and no certification date is committed. An independent external penetration test is planned and has not been completed.

Service levels

Do you offer an uptime SLA?

There is no public uptime SLA. An enterprise SLA applies only where it is agreed in signed commercial or order-form terms.

Service levels

Is a dedicated environment available?

Only through a scoped enterprise engagement or onboarding. A dedicated environment is not self-service, not provisioned automatically, and not included merely by opening an Infrastructure account.

Certifications

Which regulations does the platform support?

AMLA 2027, AMLR, MiCA, DORA, EU AI Act, Travel Rule and GDPR (as decision-support; not a regulatory determination).

Resilience

Incident Response Summary

Detection: Monitoring of platform and infrastructure signals; reports via the security contact.
Triage: Severity assessment and scoping by the security contact on a coordinated-disclosure basis.
Customer notification: Affected customers are notified without undue delay after we become aware of a personal-data breach affecting their data, with the information reasonably available to support their own notification duties.
Authority context: As processor, ReguShield assists the Customer (controller), who owns the GDPR 72-hour authority-notification obligation.
Disclosure: Coordinated disclosure via security@regushield.ai; acknowledgement target 72 hours.

Resilience

Business Continuity / Resilience

backups

Available

Managed database backups via the infrastructure provider (Supabase).

recovery

Planned

A formal business-continuity and disaster-recovery plan with tested recovery objectives (RTO/RPO) is being documented.

redundancy

Available

Managed cloud infrastructure with provider-level redundancy.

Responsible AI

AI Governance Statement

Decision-support, not autonomous regulated decisioning. EU AI Act-aligned.

Nature: Decision-support — informs but does not replace qualified compliance judgement.
Human oversight: Mandated human oversight; outputs are reviewed before any regulated action (EU AI Act Art. 14).
Explainability: Deterministic rule logic with regulatory citations and confidence indicators.
Classification: Formal EU AI Act classification and, where applicable, a Fundamental Rights Impact Assessment are being prepared (Planned).
Data use: Customer data is not used to train provider foundation models.

Full AI Governance Policy →

Assurance

Trust Roadmap

What is live today and what is planned — including certifications NOT yet held.

EU data storage & EU application compute; tenant isolation (RLS) · LiveAvailable

GDPR DPA, sub-processor register, data-subject rights · LiveAvailable

Immutable acceptance audit & policy versioning · LiveAvailable

External penetration test · Not yet completed · no date committedPlanned

DORA ICT risk mapping · No date committedPlanned

EU AI Act classification / FRIA scaffolding · No date committedPlanned

ISO/IEC 27001 (ISMS) certification · Not yet certifiedPlanned

ISO/IEC 27701 (privacy) certification · Not yet certifiedPlanned

SOC 2 (Type I → II) · Not yet certifiedPlanned

Qualified e-signature (eIDAS 2) on agreements · FuturePlanned

Assurance

Audit Calendar

Activity	Type	Status	Window
External penetration test	Security assessment	Planned	Not scheduled
ISMS gap assessment (ISO 27001)	Assurance	Planned	TBC
Sub-processor due-diligence review	Vendor risk	Planned	Annual
Policy & DPA review	Legal/governance	Planned	Annual / on change
Access & RLS control review	Security	Planned	Periodic

ActivityExternal penetration test

TypeSecurity assessment

StatusPlanned

WindowNot scheduled

ActivityISMS gap assessment (ISO 27001)

TypeAssurance

StatusPlanned

WindowTBC

ActivitySub-processor due-diligence review

TypeVendor risk

StatusPlanned

WindowAnnual

ActivityPolicy & DPA review

TypeLegal/governance

StatusPlanned

WindowAnnual / on change

ActivityAccess & RLS control review

TypeSecurity

StatusPlanned

WindowPeriodic

Vendor Risk

Vendor Risk Register

Procurement-relevant risks with mitigations — transparently disclosed.

Risk	Impact	Mitigation	Status
No third-party security certification yet (ISO 27001 / SOC 2)	Medium (procurement gating)	Transparent disclosure; ISMS programme + external pentest planned; DPA + technical measures available now.	Open
AI sub-processor processes data in the US (OpenAI)	Medium	EU Standard Contractual Clauses + supplementary measures; no model training on customer data; EU-inference option under evaluation.	Mitigated
Sub-processor concentration (managed cloud)	Medium	Named register, due-diligence review, exit-readiness documentation (DORA-aligned, planned).	Monitored
Formal BCP/DR not yet documented with tested RTO/RPO	Medium	Managed backups in place today; formal BCP/DR planned.	Open
Legal documents pending qualified-counsel sign-off	Low/Medium	Framework content published transparently; counsel review before external binding.	Open

RiskNo third-party security certification yet (ISO 27001 / SOC 2)

ImpactMedium (procurement gating)

MitigationTransparent disclosure; ISMS programme + external pentest planned; DPA + technical measures available now.

StatusOpen

RiskAI sub-processor processes data in the US (OpenAI)

ImpactMedium

MitigationEU Standard Contractual Clauses + supplementary measures; no model training on customer data; EU-inference option under evaluation.

StatusMitigated

RiskSub-processor concentration (managed cloud)

ImpactMedium

MitigationNamed register, due-diligence review, exit-readiness documentation (DORA-aligned, planned).

StatusMonitored

RiskFormal BCP/DR not yet documented with tested RTO/RPO

ImpactMedium

MitigationManaged backups in place today; formal BCP/DR planned.

StatusOpen

RiskLegal documents pending qualified-counsel sign-off

ImpactLow/Medium

MitigationFramework content published transparently; counsel review before external binding.

StatusOpen

ReguShield AI Technology UAB (planned — not yet incorporated) · Lithuania (EU member state), planned; Vilnius is the planned headquarters. ReguShield AI provides compliance decision-support intelligence — not legal advice or a regulatory determination. Status labels: Available (in use today) · Planned (not yet in place) · Not currently available.