Security

RegenticFlow holds some of your most sensitive documents. We treat that responsibility seriously — here's how we protect your data.

Encryption

All traffic is encrypted in transit with TLS. Files and data are encrypted at rest in access-restricted storage.

Isolation

Every piece of data is scoped to your account. Search and the assistant only ever retrieve your documents — retrieval is filtered by your user id inside the database query itself, not by an instruction in a prompt. That distinction matters: a prompt rule is something a cleverly worded message can argue with, and a query filter is not. Retrieved text is also treated as untrusted input, escaped and wrapped so a document cannot issue instructions to the assistant reading it.

Authentication

Sign in with Google or with an email and password (hashed with bcrypt — we never store plaintext). Sessions use signed, short-lived tokens.

AI providers

Content sent to our AI provider is processed to generate your results and is not used to train shared models.

Your assistant's visitors

A published assistant is a public surface, so it has its own boundary. Visitors pass a bot-detection challenge before they can send anything, and the token they get back is short-lived and bound to that specific assistant and that visitor — it cannot be lifted and replayed against another one.

• The embeddable widget only runs on domains you list. An empty list means our own hosted pages only, never “anywhere”.
• Public surfaces are retrieval only. A visitor's message can search the knowledge you scoped to that assistant and nothing else — it cannot create, edit or delete anything in your account.
• Transcripts and the questions asked are kept for a window you choose (7–365 days, 90 by default) and then deleted automatically.
• An assistant answers only from the space or the specific documents you bound it to, so publishing one does not expose the rest of your vault.

Your controls

• Export everything at any time, as JSON.
• Delete any document, or your whole account, permanently — deletion cascades to conversations, assistants and leads.
• Add a password to a Google account for a second sign-in method.

What we don't do yet

We would rather you find the limits here than a fortnight after paying us. As of today:

• Reminders go out by email only. SMS, WhatsApp and push are on the roadmap, not in the product.
• No team or shared accounts.One login, one knowledge base. You can't invite a colleague or share a document with a client.
• Voice is web voice. Your assistant speaks and listens in a browser. It does not answer a phone number.
• Booking is Google Calendar only. No Outlook, no Cal.com, no Calendly import.
• Card payments are live in India today. International card processing is pending gateway approval.
• We hold no security certifications.Everything above is how the system is built, not the outcome of a third-party audit. We don't claim SOC 2 or ISO 27001 because we don't have them.
• We are not the only party involved.Your content is processed by our AI provider under a no-training arrangement. We do not run our own model, and we won't pretend your data never leaves our servers.

Report an issue

Found a vulnerability? Please email security@regenticflow.com. We appreciate responsible disclosure.