Compliance program
Where our compliance stands today
What is live, what is planned, and how to get the latest evidence pack for your procurement team.
Frameworks and standards
- GDPR Live
- EAA Live
- ADA Live
- Section 508 Live
- WCAG 2.2 Live
- ISO 27001 Planned
Program status
Each area of our program, its current status and what it covers.
-
GDPR-aligned processing
LiveA DPA is available to every EU customer. EU-region hosting is available on enterprise plans. We handle subject access requests within 30 days.
-
Sub-processors register
LiveA public list of every sub-processor that handles customer data, with its purpose and location. Customers are told before a new sub-processor is added.
View the register -
EAA (European Accessibility Act)
LiveThe built-in evidence pack and VPAT generator map findings to EN 301 549. Attach them to procurement responses, or share them with a regulator on request.
-
ADA and Section 508
LiveReports cover WCAG 2.2 AA criteria with a Section 508 mapping, suitable for federal procurement VPATs.
-
ISO 27001
PlannedOn our roadmap. Customer requests help us bring it forward.
GDPR and our Data Processing Agreement
The commitments our DPA makes to you as data controller. The DPA itself is the binding text.
- Your instructions only
- We process personal data only on your documented instructions, and everyone authorised to handle it is bound by confidentiality.
- Breach notice within 72 hours
- We notify you of a personal data breach without undue delay, and in any event within 72 hours.
- 30 days' notice of new sub-processors
- We give at least 30 days' notice before adding or replacing a sub-processor.
- Standard Contractual Clauses
- Transfers outside the EEA to countries without an adequacy decision rely on the SCCs in Commission Decision (EU) 2021/914.
- Help with data subject requests
- We assist with data subject requests and impact assessments, and handle subject access requests within 30 days.
- Deletion or return at the end
- When the service ends, we delete or return all personal data at your choice, unless the law requires us to keep it.
- Audit rights
- We provide the information needed to show compliance, and accept audits at your expense up to once every 12 months.
- Defined retention
- Activity log 365 days, email logs 90 days, scan results 1 year, compliance history 2 years.
For your auditor or regulator
Reguweb customers generate an evidence package from their dashboard in one click. It bundles your accessibility records into a single zip file.
- Answer a demand letter
- Attach it to an RFP
- Share it with your DPO
Evidence package
.zip- Every completed scan
- Open issue snapshot
- Compliance history timeline
- Published accessibility statement
- VPAT
- Activity log
Compliance questions
Something else your review needs? Email our team.
Is Reguweb GDPR compliant?
Our processing is GDPR-aligned. A Data Processing Agreement is available to every EU customer, we publish our sub-processors, and we handle subject access requests within 30 days.
Where is customer data hosted?
EU-region hosting is available on enterprise plans. The sub-processors register lists the region of every vendor that processes customer data.
How do you handle transfers outside the EEA?
Where personal data goes to a country outside the EEA without an adequacy decision, we rely on the Standard Contractual Clauses adopted by Commission Decision (EU) 2021/914.
How will we hear about a new sub-processor?
The DPA commits us to at least 30 days' notice before we add or replace a sub-processor. Enterprise customers are notified by email.
How quickly do you report a data breach?
We notify you without undue delay after becoming aware of a personal data breach, and in any event within 72 hours.
Is Reguweb ISO 27001 certified?
Not yet. ISO 27001 is planned and on our roadmap. Customer requests help us bring it forward.
Can Reguweb help us show EAA, ADA or Section 508 conformance?
Yes. The evidence pack and VPAT generator map findings to EN 301 549 for the EAA, and reports cover WCAG 2.2 AA criteria with a Section 508 mapping.
Who do we contact for compliance documents?
Email no-reply@reguweb.com for the DPA, sub-processors register, penetration test summary, security questionnaire or continuity plan. We share them under NDA. Report vulnerabilities to security@reguweb.com.
Request the evidence pack
Email no-reply@reguweb.com to receive any of these documents under NDA.
- Data Processing Agreement (DPA)
- Sub-processors register
- Latest penetration test summary
- Security questionnaire (CAIQ / SIG Lite)
- Business continuity and disaster recovery plan