Trust & Security

The short version

RegCheck360 is hosted in Sydney, Australia. Your data stays in Australia. Every connection is encrypted, and your saved formulas are treated as commercially sensitive — they are never shown to other customers or to manufacturers unless you explicitly request a quote.

If you find a security issue, email security@regcheck360.com and we will respond within 24 hours.

Where your data lives

The application runs on Vercel’s Sydney edge, and the database is hosted on Supabase in Sydney. Backups stay in the same region. We do not move customer data offshore.

A handful of well-known providers help us run the service. Stripe processes payments (we never see card numbers). Resend sends transactional email. Cloudflare sits in front of the site for DNS and bot protection. Sentry collects error reports from the application code.

The full sub-processor list is in our Privacy Policy, and we notify customers before adding a new one that handles personal information.

How we protect it

Every page and API call is served over HTTPS, and browsers are instructed to refuse any plain-HTTP fallback. Customer data is encrypted at rest in the database and in file storage. The site sets the standard hardening headers a modern web app should set (clickjacking, MIME-sniffing, and referrer leakage are all blocked), and we do not ask for camera, microphone, or location access from the browser.

Sign-in is handled by Supabase Auth. Passwords are stored as one-way hashes — we never see them in plain text. Sessions use short-lived access tokens that rotate automatically. Two-factor sign-in and single sign-on (Google Workspace, Microsoft Entra) are on the roadmap for the Team plan.

Customer accounts are isolated at the database level: queries running under your login can only return rows that belong to you. The keys that bypass this isolation are restricted to server-side code and rotated when staff change.

Your formulas, specifically

Formulas you submit are commercially sensitive, and we treat them that way. They are encrypted at rest, and access is gated by your account. If you delete your account we delete your formula records, except where we are legally required to keep something (for example, tax records of payments).

Continuity

Supabase takes daily managed backups of the database with point-in-time recovery on the paid tier. The application servers themselves are stateless — restoring the database restores the service. Our regulatory data pipelines are idempotent, which means we can re-run them at any time against the current TGA, FSANZ, ANVISA, and Health Canada sources without losing anything.

We monitor the service with Sentry for application errors and Uptime Kuma for external probes. Live status is at uptime.healthicons.ai/status/regcheck360.

Compliance, honestly

We operate under the Australian Privacy Principles, and our breach response follows the Notifiable Data Breaches scheme. Stripe handles card payments, which keeps us out of card-data scope.

We do not currently hold a SOC 2, ISO 27001, or HIPAA attestation, and we will not claim one we do not have. SOC 2 Type I is on the roadmap for when our enterprise pipeline justifies the engagement. If you need to satisfy a procurement checklist before then, the next section is for you.

Reporting a security issue

Coordinated disclosure is welcome. Email security@regcheck360.com with details and, where possible, a proof of concept. We will acknowledge within 24 hours and keep you updated through to resolution.

We ask that you give us a reasonable window (90 days by default) before public disclosure, do not access data that is not your own, do not run automated scanners against authenticated endpoints, and do not affect service availability.

Machine-readable contact information is at /.well-known/security.txt.

For procurement teams

Need a vendor questionnaire filled out, a DPA signed, or a security walkthrough? Email sales@regcheck360.com and we will turn it around within a few business days.