Trust
Trust centre
Regulaxy installs on your servers, reads from your databases and sends mail through your mail server. This page explains what that means in practice, and what we do and do not have when a security reviewer asks.
Your data never leaves your network
That is not a contractual promise; it is a consequence of the architecture. The product has no outbound channel. It reports no telemetry, fetches nothing at runtime and calls no service of ours. A deployment with no internet access works in full — that is the case it was built around.
The facts, briefly
- Deployment model
- On-premises only, including air-gapped networks
- Our access to customer data
- None. We do not receive, store or access the data in it
- Telemetry in the product
- None
- Outbound traffic from the product
- None. Not even a licence check
- SOC 2 Type II
- None
- ISO/IEC 27001
- None
Certifications — what we have and what we do not
Regulaxy does not currently hold a SOC 2 Type II report or ISO/IEC 27001 certification. We are placeholder: pursuing / not yet pursuing placeholder: which, with a target of placeholder: date. We will publish the report here when we have it. In the meantime, the controls we operate are described below, and we will complete your security questionnaire on request.
Why it is written that way
We could have written "enterprise-grade security" here and put a badge next to it. A bank's security reviewer checks certifications, and wording that sounds like one without being one reads exactly as what it is. Better to say we do not have it, and hand over what we do.
Security questionnaire
We complete customer security questionnaires. Until there is an audit report to point at, that is the practical way to assess us.
Penetration testing
Cadence and tester: placeholder: cadence
verify: Not yet confirmed internally whether a penetration test has been performed. If not, get one before selling to a financial institution — it is asked for in the first questionnaire.
Where the data is
Product data: stays in your database, on your network. We hold no copy, and there is nothing at our end to delete.
Website data (enquiries, leads, mailboxes): placeholder: region
For customers in the EEA and UK: the European Commission recognises Israel as providing an adequate level of protection for personal data, most recently reaffirmed in its January 2024 review of pre-GDPR adequacy decisions. Transfers to us rely on that decision and need no additional contractual safeguards.
Stated honestly: the 2011 adequacy decision is subject to ongoing monitoring, and civil-society groups have urged the Commission to reassess it. It stands today. We do not describe it as permanent.
Availability
We do not run a status page. Regulaxy is not a hosted service — it runs on your infrastructure, and its availability is your infrastructure's. A status page from us could be read as implying we run something for you, and we do not.