Trust & Security

RegRadar only pulls public regulatory data down to you. It never accepts your customers' nonpublic personal information (NPI) or protected health information (PHI). There are no free-text client-notes fields anywhere, and inputs actively reject SSN and policy-number patterns. This design is what keeps RegRadar outside GLBA and HIPAA scope.

All data is stored in the United States. The database and authentication run on Supabase (US region) with row-level security enforced on every table, so one tenant can never read another's data. Evidence snapshots of each detected change are archived to Cloudflare R2.

Encryption in transit (TLS everywhere) and at rest. Least-privilege access, with multi-factor authentication available. Every privileged action is written to an immutable audit log. Secrets live only in environment variables — never in code or version control.

We rely on a small, vetted set of subprocessors to run the service. See the full list.

Security questions or vulnerability disclosures are welcome at security@naicmonitor.com. We also publish a machine-readable security.txt.