Security at Reguweb
How we keep customer data confidential, intact and available: encryption, access control, monitoring and patching, stated plainly.
Security controls summary
Encryption, access control and layered defences around the Reguweb application.
TLS 1.2 or higher on every customer-facing endpoint. HSTS is enforced on the dashboard and the embed widget.
AES-256 on the application database, scan result blobs and ticket attachments. Billing data managed through Stripe has defined retention windows.
Production access is role-based, requires MFA and is audit-logged. On enterprise plans, the customer panel supports single sign-on through SAML or OIDC.
TOTP two-factor authentication is available on every account. Administrators can require it for all customer accounts.
The routines that catch issues before they reach you.
A scheduled job deletes these records when their retention window ends.
We acknowledge every report within one business day and triage it the same week.
We do not run a bug bounty program yet. With your consent, we publicly credit researchers who report material issues.
Working through a questionnaire? Ask for ours.
Every customer-facing endpoint uses TLS 1.2 or higher, and HSTS is enforced on the dashboard and embed widget. At rest, the application database, scan result blobs and ticket attachments are encrypted with AES-256.
Production access is role-based, requires MFA and is audit-logged. Access to the customer database is limited to a named on-call rotation, and every access event is audited.
TOTP two-factor authentication is available on every account, and administrators can require it for all customer accounts. Single sign-on through SAML or OIDC is available on enterprise plans.
Composer audit runs in CI on every deploy. We patch high-severity dependency CVEs within 7 days.
Yes. Database backups are encrypted, point-in-time recovery is enabled, and we test the restore procedure every quarter.
Under our Data Processing Agreement we notify you without undue delay, and in any event within 72 hours of becoming aware of the breach.
Email security@reguweb.com with steps to reproduce, the affected version and your contact details. We acknowledge reports within one business day and triage them the same week.
Our evidence pack includes the latest penetration test summary and a completed security questionnaire. We share it under NDA.
