Security & Trust

Built to the standard your auditors expect.

REGARA™ handles regulatory submissions, IP, and PHI. We've designed the platform — and the company — around the assumption that an inspector will eventually want to see how it works.

Compliance roadmap
ISO 27001In progress SOC 2In progress HIPAAIn progress
Data protection

Your submissions are yours. Always.

We don't train shared models on customer data. We don't sell aggregated insights. We don't ship a product whose business model depends on either.

  • 01
    No training on customer data.

    Customer submissions, claims, and correspondence are isolated per tenant and never used to train shared foundation models. Customer-specific fine-tuning is opt-in and scoped to that customer's models only.

  • 02
    Encryption everywhere.

    TLS 1.3 in transit. AES-256 at rest. Customer-managed encryption keys (CMEK) available on enterprise plans — bring your own KMS root in AWS, Azure, or GCP.

  • 03
    Single-tenant deployment.

    For sensitive programs, REGARA™ deploys as a fully isolated single-tenant stack in the region of your choice. Available on enterprise plans.

  • 04
    PHI-safe by default.

    Infrastructure built for HIPAA compliance — program in progress, with a BAA planned for paid plans. Automatic PHI detection and redaction at ingest, with detection results available in the audit log.

Compliance program

A program, not a one-time audit.

ISO 27001
Information security

ISO 27001 (ISMS) certification in progress. Compliance roadmap and Statement of Applicability available under NDA.

Request SoA
SOC 2 Type II
Continuous monitoring

SOC 2 Type II examination in progress. Controls are monitored continuously ahead of our first report; roadmap available under NDA.

Request roadmap
HIPAA · BAA
PHI-handling commitments

Business Associate Agreement planned for Pro and Enterprise plans. Architecture review with your privacy team on request.

Request BAA
Penetration testing
Annual third-party tests

Annual penetration test by a CREST-certified vendor. Executive summary shareable under NDA; remediation closes within published SLAs.

Request summary
Model governance

An AI you can defend in front of an auditor.

REGARA™'s outputs are designed to be inspectable. Every generation is reproducible from its inputs and the model state at the time it was produced.

  • ·
    Versioned model state.

    Every model — base, fine-tuned, and retrieval index — is pinned to a version. Re-running a generation from six months ago produces an output identical to the original.

  • ·
    Citation provenance.

    Every cited document is hash-anchored. If a guidance document is updated, prior citations resolve to the version that was current at generation time.

  • ·
    Hallucination controls.

    Retrieval-grounded generation with claim-level verification. Outputs that can't be anchored to a source are flagged, not surfaced.

  • ·
    Human-in-the-loop required.

    REGARA™ does not submit to agencies. Every output passes through a reviewer with approval logged in the audit trail.

Trust center

Documents you can share with your security team.

Certificate
ISO 27001 (in progress)

Certification roadmap and Statement of Applicability. Available under NDA.

PDF · NDA required→
Policy
Information Security Policy

High-level summary of REGARA™'s information security program.

PDF · Public→
Policy
Subprocessors list

Current list of subprocessors, with location and purpose.

Web · Public→
Architecture
Security & architecture whitepaper

Detailed architecture, data flows, and control mappings.

PDF · NDA required→
Status
Status page

Live availability, incidents, and maintenance windows.

Web · Public→
Security questionnaire?

Send it. We answer within 48 hours.

CAIQ, SIG, custom — our security team handles the response. Walkthrough with your team on request.

Talk to security →