Security
Boring on purpose
A readiness product holds sensitive facts about how your company operates. Here is exactly how we treat them.
Encryption everywhere it moves or rests
All traffic is TLS 1.2 or better. Stored data is encrypted at rest by our infrastructure providers. There is no plaintext path for your answers, anywhere.
Your answers are never training data
Company data is sent to a model provider only to produce your assessment, under API terms that exclude training on your content. Regolyn itself never trains anything on customer data, and we do not build cross-customer datasets from answers.
Least privilege, few hands
Production access is limited to the engineers who operate the system, behind hardware-key MFA. Support never reads your assessment without your explicit, logged consent on a ticket.
Deletion means deletion
Account deletion removes your user record, intake, and assessments immediately from the primary store. Provider-level backups age out on their standard schedule and are never restored to production except in a disaster.
Passwords handled like it is 2026
Passwords are hashed with scrypt and never stored or logged in any recoverable form. Sign in with Google is available if you prefer to hold no password with us at all.
Small surface on purpose
Regolyn needs no access to your codebase, your cloud, or your HR system. The product works from what you tell it, which keeps the blast radius of any incident structurally small.
Subprocessors
Who touches the data, and why
| Provider | Purpose | Region |
|---|---|---|
| Vercel | Application hosting and storage | United States |
| OpenAI or Anthropic | Model inference for assessments, no training on your content | United States |
| Neon | Postgres database, when configured | United States |
| Resend | Transactional email, when configured | United States |
Found something?
Report vulnerabilities to security@regolyn.com. We acknowledge within one business day, we do not pursue good faith researchers, and we credit fixes if you want the credit.