Security · data protection
You are handing a compliance platform your firm's most sensitive records. Here is exactly how we hold them: where they live, who can reach them, and what we will never do with them.
What we do today
Written for procurement: the controls that are in place today, the sub-processors that see your data, and where the limits are. It prints clean.
Firm data is stored in the United Kingdom (London, eu-west-2), and stored data stays there. When the AI does work, only the context it needs leaves the UK, and only to the sub-processors named in section 06, under the terms set out there.
Data is encrypted in transit (TLS) and at rest. Each specialist runs behind a circuit breaker that halts it if it behaves unexpectedly, with per-firm spend ceilings on specialist AI work and a daily ceiling on assistant usage.
Every table holding your firm's data is isolated per firm, enforced in the database rather than in application code, so a query made for one firm cannot return another firm's rows. Access within your firm is role-based. Administrative access to the platform itself is held only by named RegForge staff accounts.
Every action writes an append-only audit record: the inputs, the reasoning, and the Handbook references cited. The audit trail is append-only in use: no user and no specialist can change or delete a record's content; the only permitted change is placing or lifting a legal hold. Records leave it only under RegForge's retention schedule for your firm (default seven years; rows under legal hold are kept) or when a firm is erased at its own request. Specialist actions can be reversed from the feed where a revert handler exists.
“Four meeting actions overdue: 2 with Hana, 1 with Oliver, 1 unassigned. The 6 March audit committee minutes are still empty 47 days on. I've drafted placeholder minutes from the agenda for the chair to review, and three follow-up emails offering complete / extend / cancel. None are decisions for me to take.”
RegForge acts as processor for your firm's data under UK GDPR Article 28; your firm remains the controller. Written processing terms are being finalised; RegForge will not take on an arm's-length firm before they are accepted. Two AI sub-processors: Anthropic and OpenAI, both processing in the United States; data is stored in London (eu-west-2).
When the AI does work, only the context it needs is sent to our AI sub-processors: Anthropic (Claude, for drafting and document reading) and OpenAI (for search embeddings), both processing in the United States. Neither trains on your data. We do not train our own models on your data either, unless you explicitly opt in to anonymised product improvement. The AI reads your context to do the work in the moment; it does not learn from it for anyone else.
For our current sub-processor list, ask us and we will share it.
Certifications
The protections above are facts you can verify, not badges. For formal attestations, SOC 2, ISO 27001 and independent penetration-test reports, ask us for our current status and we will share where each one stands.
We will not claim a certificate we do not hold, and we will not dress a roadmap up as a control. When something lands, it will say so here, with a date.
Questions about data residency, the processing terms, or our sub-processors? Bring them to the founder. Twenty minutes, ex-FCA, no slides.
Talk to us for 20 minutes