How we keep your regulatory work safe.

Data residency

Customer data is stored in the EU (Cloudflare D1 and R2, EU jurisdiction). Requests are processed on Cloudflare's global network. AI features use Anthropic's Claude models and Google's embedding model through Cloudflare AI Gateway.

• We cannot choose where a request is decrypted and processed. Cloudflare Workers run near the user.
• Anthropic processes requests to its Claude models in the United States.
• Cloudflare Email Sending keeps the recipient and subject of our transactional email for up to 30 days.

Authentication

You sign in with an email address and password or with Google. Two-factor login is optional for customer users and mandatory for platform admins. Anyone who has enrolled in two-factor login is asked for it at every sign-in, with a password or with Google. Cloudflare Turnstile checks sign-up, sign-in and password reset for bots.

Membership enforcement

The server checks every request for a signed-in user and for membership of the company that owns the data. Admins give each member the permissions they need. Answers saved from Ask are private to the user who asked.

AI disclosure

Everything RegsApplied generates is labelled as AI output. Applicability analyses carry the notice "AI-generated. It can be wrong and is not legal advice." Reginald, the assistant in Ask, says "Reginald is an AI assistant. Answers can be wrong and are not legal advice." Word and CSV exports carry the label "AI-generated draft. Not yet signed off." until a user with the sign-off permission signs off. They also carry machine-readable provenance with the generator, the model, the date and the sign-off status.

Payments

Orders are billed by annual invoice. The product does not collect or store payment card details.

Observability

Logs, traces and error reports are kept in Cloudflare Workers Logs, Traces and Issues, with no separate monitoring vendor. Personal data is scrubbed before anything is logged. Errors from the browser app go to our own endpoint, not to a third-party error service.

Data export

Users with the export permission download plans and documents as Word and CSV files.

Subprocessors

These vendors process customer data for us.

• Cloudflare. Hosting, database, storage, email and AI routing.
• Anthropic. The Claude models that write answers and drafts, reached through Cloudflare AI Gateway.
• Google. The gemini-embedding-001 model, which turns questions into embeddings for search, and Continue with Google sign-in.