Privacy Policy
Last updated: October 2026
1. What We Collect
We collect account information you provide (name, email, company name, phone number), and the compliance data you create within the platform (risks, audits, policies, documents, vendor records, and related metadata).
2. How We Use Your Data
Your data is used to operate the Service: authenticating your account, scoping data to your organization (tenant), generating compliance reports and dashboards, and sending you operational notifications (e.g. approvals, reminders).
3. Data Isolation
Regulane is a multi-tenant platform. Every organization's data is logically isolated and scoped to that organization; users from one organization cannot access another organization's records.
4. Third-Party Processors
We use the following providers to deliver the Service. Each processes data only as needed to provide its service to us. Google Firebase: sign-in and account credentials. Prisma (Prisma Postgres): the database holding your workspace records. Vercel: application hosting, with our application servers in Singapore, and storage of the files you upload. Resend: transactional email such as verification, password reset and assignment notifications. Anthropic: when someone in your workspace uses an AI feature, the question and a summary of the relevant workspace records are sent to Anthropic's Claude to produce the answer; nothing is sent if AI features are not used. For REGUBOT, the in-app companion, that is the question, the recent messages of that conversation, the name of the page it was asked on, the person's chosen name and explanation style, and only the records REGUBOT's tools read to answer that question (for example the titles, scores and due dates of open risks); colleagues are not named. REGUBOT's help search and navigation make no AI request. Cashfree Payments: online payment processing; card and bank details are entered with Cashfree and never reach us.
4a. Google Workspace Integration
If a company administrator connects Google Workspace, Regulane reads, through Google's Admin SDK with read-only access, the user directory of that Workspace: each account's email address, whether it is suspended or archived, whether it is an administrator, whether 2-Step Verification is enrolled and enforced, and when it was created and last signed in. It also records the email address of the administrator who connected. This is used only to run the security checks shown on the Integrations screen (2-Step Verification, administrator accounts and unused accounts) and to keep them current with a daily check. The access token is stored encrypted. Check results, including the email addresses of accounts that fail a check, are kept for up to 90 days. Disconnecting revokes Regulane's access at Google and deletes the stored results. Data received from Google is not sold, not used for advertising, not used to train any model, and not sent to Anthropic or any other AI provider. Regulane's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
4b. GitHub Integration
If a company administrator connects GitHub, the Regulane GitHub App is installed on that GitHub organisation with read-only permissions, and only for the repositories the organisation's owner chooses. Regulane reads: whether the organisation requires two-factor authentication; the usernames of members and owners and which of them lack two-factor authentication; the usernames of outside collaborators; and, for each shared repository, its name and whether its default branch requires a pull request. Regulane does not read source code, issues or pull requests, and cannot change anything. It also records the GitHub username of the person who connected. No GitHub password or token is stored: access tokens are created for each daily check and expire within an hour. Check results, including the usernames and repository names that fail a check, are kept for up to 90 days. Disconnecting uninstalls the app from the organisation and deletes the stored results. Data received from GitHub is not sold, not used for advertising, not used to train any model, and not sent to Anthropic or any other AI provider.
5. Data Retention
While your workspace is active, its records are kept until someone in your workspace deletes them; Regulane does not delete them on a schedule. Results from connected integrations (Google Workspace, GitHub) are kept for up to 90 days and deleted when the integration is disconnected. When a workspace is closed it is first archived: nobody can sign in, nothing is deleted, and it can be restored. On your request, after at least 24 hours in the archive, it is permanently deleted: every record, every uploaded file, and every member's sign-in account, and any integration access is revoked at the provider. This cannot be undone. Any backup copy of the database is encrypted and kept for no more than 30 days, so deleted data leaves backups within 30 days of deletion. Payment records are also held by Cashfree, our payment processor, under its own legal retention obligations. A company administrator can download a complete copy of the workspace's records at any time from Workspace settings; only the most recent export file is kept, and it is deleted with the workspace. Audit packages prepared for an auditor are kept for 30 days and then deleted. REGUBOT conversations are visible only to the person who had them and are deleted 90 days after their last message; each person can delete their own sooner from REGUBOT's settings, and feedback on an answer is deleted with it. When REGUBOT cannot answer a question from Regulane's help, it may record the topic in general words, with names, figures and contact details removed, so that Regulane can write a help article; only the topic and how many workspaces raised it are kept, not the question or which workspace asked. A company administrator can turn this off in REGUBOT's settings. The workspace's audit trail (who changed what, and when) cannot be edited or deleted while the workspace exists; it is deleted with the workspace. It records free text, such as notes and descriptions, only as its length and a fingerprint, not the words, so personal data written in a record can be corrected or erased there.
5a. Where Your Data Is Stored
Regulane's application servers run in Singapore. Your workspace records are held in a Prisma Postgres database in the United States (AWS us-east-1, North Virginia), and your uploaded files in Vercel Blob storage. Data in a workspace is therefore transferred outside India, which the Digital Personal Data Protection Act, 2023 permits except to countries the Government restricts by notification. Sign-in accounts are held by Google Firebase, email passes through Resend, and AI requests, when used, are processed by Anthropic; these providers may process data in other countries, including the United States, under their own data-protection terms. Data is encrypted in transit (TLS) between your browser, our servers and each provider.
6. Security
We use industry-standard safeguards including encrypted connections (TLS), hashed/managed credentials, and role-based access controls. No method of transmission or storage is 100% secure, but we work to protect your data using currently accepted industry standards.
7. Your Rights
You may request access to, correction of, or deletion of your personal data by contacting us. A company administrator can export the workspace's records themselves at any time. Depending on your jurisdiction, you may have additional rights under applicable data protection law (e.g. GDPR).
8. Cookies
We use a minimal, functional session cookie to keep you signed in, and two preference cookies that remember your light or dark theme and whether the sidebar is collapsed. REGUBOT keeps where you have moved it, whether it is tucked away and how often it greets you in your browser's local storage, on that device only. We do not use third-party advertising cookies on the application itself.
9. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated via email or an in-app notice.
10. Contact
Questions about this Privacy Policy or your data can be sent to support@regulane.com.
Also see our Terms of Service.