Your data stays yours
We never sell your data or use it to train AI models. This page explains how we protect it and who else processes it.
Our security principles
What you can hold us to
No data sharing beyond the service
Your questionnaire data, organisation profile, and answers are never sold and never visible to other customers. We only pass them to the subprocessors we list, and only to run the service for you.
No model training on your data
We use Anthropic’s commercial Claude API for AI processing. Under Anthropic’s commercial terms, data sent through the API is not used to train its models, and we never use your data to train or fine-tune anything either.
Encryption everywhere
All data is encrypted in transit using TLS. Sensitive fields, including questionnaire text, AI-generated answers, your answer bank and user names, are individually encrypted at the application level before they reach the database.
Multi-factor authentication
MFA is available for all accounts and can be enforced organisation-wide by admins. We support TOTP-based authenticator apps and backup codes.
Role-based access control
Team members only get access to what they need. Admins control user roles, MFA policies and organisation settings.
Application security
Hosted on Amazon Web Services in the UK. Strict security headers (CSP, HSTS, X-Frame-Options) on every response, rate limiting on the API, and account lockout after repeated failed sign-ins.
How we handle your data
What data does Reguard AI process?
We process the questionnaire files you upload (XLSX), the organisation security profile you provide, and the answers you create or approve. This data is used solely to generate draft answers for your questionnaires.
How is AI processing handled?
We use the Anthropic Claude API to classify questions and draft answers. The relevant question, together with the parts of your organisation profile and answer bank needed to answer it, is sent to the API at the point of processing. Anthropic’s commercial terms state that API data is not used for model training; Anthropic retains API inputs and outputs only for the limited period set out in its data retention policy.
Where is my data stored?
Your data is stored on Amazon Web Services infrastructure in the UK. Sensitive fields, including your questionnaire questions, AI-drafted answers, confirmed answers, answer bank entries, organisation profile snippets and user names, are encrypted at the application level using AES-256-GCM with unique salts per value. Even with direct database access, these fields cannot be read without the encryption key.
Who can access my data?
Only authenticated members of your organisation can access your data, governed by role-based permissions. Reguard AI staff do not access your questionnaire content unless you ask us to as part of a support request.
Can I delete my data?
Yes. You can delete questionnaires, along with their questions and answers, and answer bank entries yourself at any time. To close your account and delete all of your organisation’s data, contact us and we’ll do it for you.
Is data shared between organisations?
No. Each organisation’s data is completely isolated. There is no cross-tenant data access, sharing, or visibility. Your answer bank, organisation profile, and questionnaires are exclusively yours.
Who processes your data
We keep the list short and publish it in full
Anthropic
United StatesAI processing: classifying questions and drafting answers via the Claude API.
Amazon Web Services
United KingdomHosting, database and file storage for the Reguard AI application.
Full details, including transfer safeguards, are on our subprocessors page.
Technical safeguards
The controls in place today
Want the full detail?
Read the details in our data processing addendum and subprocessor list, then get started.