Last updated: 2026-11-06
Regscribe ("Regscribe", "we", "us") is a small, solo-founder tool. This page describes how we actually handle security today — plainly, and without overstating it. See our Privacy Notice for what personal data we collect and why; this page focuses on the security side.
Where we stand today
Regscribe itself has not undergone an independent SOC 2 or ISO 27001 audit. We're a small team building on infrastructure that has — see below for exactly what each of our providers holds, sourced from their own trust-center pages. We'd like to pursue our own certification once Regscribe has real customers and the scale to justify it; until then, this page tells you what's actually true rather than implying something that isn't.
Infrastructure and sub-processors
Regscribe doesn't run its own servers or manage its own cloud infrastructure. We build on three providers, each independently certified for their own part of the stack:
- Vercel hosts the application, including Vercel Blob — a private, token-gated object storage service used only as a brief relay for larger document uploads (files above roughly 4MB use it to get around a hosting-platform request-size limit; smaller files skip it entirely). Every file placed there is deleted by our own code in the same request it's used for, immediately after being read — it is never a place a document is kept, just a wider mail slot to get it into the application. Vercel holds a SOC 2 Type 2 attestation (Security, Confidentiality, and Availability) and ISO/IEC 27001:2022 certification for its platform. See Vercel's security & compliance page.
- Vercel Postgres (added 2026-08-01, built on Neon, UK region) is the database holding the sign-in allowlist, audit-trail metadata, and AI Governance vendor-assessment results described in our Privacy Notice, plus an internal, admin-reviewed queue of AI-proposed regulatory-rubric-update suggestions, which records the reviewing administrator's email address on approval/rejection and is covered in the Privacy Notice. It's offered as a native Vercel Marketplace integration; we haven't yet independently confirmed whether it's covered under Vercel's own certifications above or under Neon's separately — flagged here honestly as unconfirmed rather than assumed, same standard as the rest of this page.
- Anthropic processes the content of documents you upload, to run the AI analysis (see our Privacy Notice for detail on this flow). Anthropic holds SOC 2 Type I & Type II, ISO/IEC 27001:2022, and ISO/IEC 42001:2023 (the AI-specific management-system standard) attestations. By default, Anthropic does not use API inputs or outputs to train its models. See Anthropic's trust center.
- Microsoft (Entra ID) handles sign-in. Entra ID is part of Microsoft's Azure / Microsoft 365 family of cloud services, which hold ISO/IEC 27001 and SOC 2 Type 2 certification. See Microsoft's Azure compliance documentation.
Important: these certifications cover each provider's own infrastructure and controls — not Regscribe's own application code. We're not claiming Vercel's, Anthropic's, or Microsoft's certifications as our own; we're telling you what we build on, and being separately honest about what we haven't done ourselves yet.
Encryption
All traffic to and from Regscribe is encrypted in transit (HTTPS/TLS), enforced by Vercel's platform. Document content is processed transiently and discarded, never written to disk on our side (see our Privacy Notice). Updated 2026-08-01: Regscribe now also has a database (Vercel Postgres, built on Neon) holding a sign-in allowlist, audit-trail metadata, AI Governance vendor-assessment results, and an internal queue of AI-proposed regulatory-rubric-update suggestions — Neon encrypts data at rest by default as part of its own platform (we haven't independently audited this beyond their own published claims, consistent with the rest of this policy's approach to vendor-inherited controls, see "Hosting & infrastructure" below).
Browser-level protections
Added 2026-11-06, alongside Regscribe moving to its own domain (regscribe.ai). Every response from Regscribe carries a set of HTTP security headers enforced by the browser itself: Strict-Transport-Security (forces HTTPS on every future visit, including the very first one), X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, and a Content-Security-Policy (CSP) that restricts the page to only loading scripts, styles, fonts, and images from Regscribe itself — blocking a whole class of attack where a third party gets malicious content to run on the page. The policy also blocks Regscribe from ever being embedded in another site's frame (frame-ancestors 'none') and blocks browser plugin content entirely (object-src 'none').
Email authenticity. regscribe.ai's domain now publishes both an SPF record and a DMARC policy, the standard mechanisms that let receiving mail servers verify an email claiming to be from @regscribe.ai actually came from our mail provider — making it harder for someone to convincingly spoof info@regscribe.ai in a phishing attempt. DMARC is currently running in monitoring mode while we confirm no legitimate mail gets misclassified, before moving to full enforcement.
Access control
Sign-in is handled entirely by Microsoft Entra ID — Regscribe never sees or stores your password. Access to the /check tool and the AI Governance vendor-assessment tool requires an authenticated session and, as of 2026-08-01, membership on an internal allowlist — Regscribe is currently invite-only, and an unauthorised email is rejected at sign-in even with valid Microsoft credentials. A separate /admin area (audit trail, allowlist management, an AI regulation-watcher tool, and internal system documentation) is restricted further, to two named administrator accounts.
Data retention
Document content and full analysis results exist only for the duration of your session and are discarded immediately after — there's no retained copy of either to secure or delete. This includes the brief Vercel Blob relay described above: our code deletes the uploaded file from that storage in the same request it's read for analysis, whether the analysis that follows succeeds or fails. Updated 2026-08-18: a narrower set of metadata — the sign-in allowlist, the audit-trail summary, AI Governance vendor-assessment results, and the internal rubric-update review queue (all described in the Privacy Notice) — is retained indefinitely in our database. The allowlist and audit-trail entries can be removed by an administrator; rubric-update suggestions and vendor-assessment results currently have no deletion path in the application itself. See our Privacy Notice for the full detail on exactly what is and isn't retained.
Vulnerability management
Updated 2026-08-01: Regscribe has had an internal, single-reviewer security test performed (not an independent third-party penetration test) — it covered authentication/authorization, common injection classes, dependency vulnerabilities, and AI-specific risks like prompt injection. Findings were fixed the same day; full detail is in our internal validation records, not published externally. Regscribe has not undergone an independent, third-party penetration test. Regscribe is live and in active use, currently in early access, with a small, active development pace; dependencies are kept current and known-vulnerability advisories are addressed as they're identified. This will mature (regular independent pen-testing, a formal vulnerability disclosure process) as the product and its customer base grow.
Reporting a security issue
If you believe you've found a security issue in Regscribe, please contact us at info@regscribe.ai.
Changes to this page
We'll update this page as Regscribe's architecture or certification status changes — including if we pursue our own SOC 2 or ISO 27001 audit, or if our infrastructure providers change.
This page was drafted 2026-07-31 to reflect Regscribe's actual current infrastructure and certification status, based on direct research of Vercel's, Anthropic's, and Microsoft's own official trust-center/compliance pages, and cross-checked against the codebase again on 2026-08-18. Published as final, on the same basis most small SaaS companies publish a security policy without individual legal review — the standard to hold this page to is factual accuracy about what Regscribe actually does (particularly avoiding the FTC/consumer-protection risk of overstating compliance claims, which this page is deliberately written to avoid), not a solicitor's sign-off.