Security

Security at RegNexus

We build Lumen for regulated industries. Security and data integrity are foundational to everything we do.

Encryption
All data is encrypted in transit (TLS 1.2+) and at rest (AES-256). Database connections use SSL. No unencrypted data leaves our infrastructure.
Authentication
Supabase Auth with secure session management. Role-based access controls (owner, admin, teacher, student). Organisation-level data isolation.
Row-Level Security
Every database table enforces Row-Level Security (RLS) policies. Tenants can never access another organisation's data, even if application logic fails.
Hash-chained records
Competence records, decision receipts, and audit logs use SHA-256 hash chaining. Every record links to the previous, creating a tamper-evident chain.
Infrastructure
Hosted on Supabase (SOC 2 Type II) and Vercel. Primary database in EU region (eu-west-2). Edge deployment for application performance.
Audit trails
Immutable audit log with no UPDATE or DELETE permissions. Every significant action is recorded with actor, timestamp, and cryptographic hash.

Data isolation

Lumen is a multi-tenant platform with strict data isolation. Every table includes an organisation identifier, and Row-Level Security policies enforce that users can only access data belonging to their own organisation. This isolation operates at the database level, independent of application logic.

AI data handling

When AI features are used (content generation, teaching assistance), we apply anonymisation measures before sending data to AI providers. No personally identifiable information is sent to third-party AI models. AI providers (Anthropic, OpenAI) are bound by data processing agreements and do not use our data for training.

Responsible disclosure

If you discover a security vulnerability in Lumen by RegNexus, please report it responsibly to security@reg-nexus.com. We will acknowledge receipt within 24 hours and work to resolve verified vulnerabilities promptly. We ask that you do not publicly disclose vulnerabilities before we have had a reasonable opportunity to address them.