Data handling

Trust

What reggate stores, what it does not have to store, and what it does not claim yet.

What we store

Under the optional minimal posture, the input fields on your sensitive list are tokenized before storage. A default list covers names, contact details and common identifiers, and you can add to it. Other fields are stored as sent, and evaluation runs on what is stored, so the record still explains its own verdict.

The full posture is the default: decision inputs are stored as sent, and they age out on your retention schedule.

Retention

Decision inputs age out per organization via a retention sweeper, after 365 days by default. An admin can change the period, and a period of zero keeps inputs. The rest of each record, including the proposed action, stays with the ledger and its chain.

Encryption in transit

With production settings, the gate refuses to start unless its connection to Postgres uses TLS.

Planned subprocessors

The gate is not deployed, so none of these holds decision data today. When it is hosted, it will use:

Fly.io, for application hosting
Neon, for Postgres database hosting
Vercel, for this marketing site only, which never touches decision data
Resend, for the signup verification email

What we do not claim yet

What reggate claims today, with its source, beside what it does not claim yet
Claimed, with source	Not claimed yet
Each decision is checked before it happens and returns ALLOW, REFER or BLOCK. Source: README	The gate is not deployed. Closes when a hosted gate is running.
Rules compile at authoring time with static bounds, and a rule that errors fails closed. Source: README; claims ledger, rows 1-2	No SOC 2 and no pen-test letter. Closes when an audit report and an outside pen-test letter exist.
Every decision is recorded against the rule-pack version in force. Source: README; claims ledger, row 4	No design partner has run a real book. Testing and the examples on this site use synthetic data. Closes when a design partner replays a real book.
Shadow mode evaluates every decision without enforcing it, and the console marks each result "SHADOW · not enforced". Source: design bible, integrity notes, shadow mode	Integrity proofs are being hardened on open pull requests. Closes when those pull requests merge and a red team proves them again.

The minimal PII posture exists to make the security conversation shorter, not to substitute for an audit.

One machine. The rate limiter and metrics counters are in-process, so the gate runs as a single instance.
Inline-proxy mode is specified and not built. The event API is the only ingestion path until it is.