Access
Accounts use single-use email codes that expire after ten minutes. Sessions expire after thirty days, can be revoked, and use secure, HTTP-only cookies.
Security and data handling
How RegLayer handles company and account data.
This page describes the controls, infrastructure, and data-handling practices in use today.
Encryption
Public traffic is encrypted in transit with HTTPS/TLS. Primary account and research data is stored in Cloudflare D1, which encrypts D1 data at rest using AES-256. Operational secrets remain outside the source repository.
Service providers
Cloudflare hosts the application and stores account data. OpenAI processes profile and question content when requested analysis runs. Resend sends sign-in codes and operational email.
Account separation
Customer records are scoped to the signed-in account. Shared regulatory materials and private company context are handled separately.
Retention and deletion
Customer documents are stored for the duration of the relevant workspace and may be deleted by the account owner. One-off Decision Brief workspaces are retained for 12 months after delivery. Deleted customer content is removed from active systems promptly and from residual backups within 30 days. Customer data is not used to train shared or public models.
Incident notification
Report suspected security issues to hello@reglayer.ai. If a confirmed incident affects account data, RegLayer will notify affected accounts at their registered email within 72 hours of confirmation.
Security contact