Skip to content
RegenticFlow

Security

Last updated

RegenticFlow holds some of your most sensitive documents. We treat that responsibility seriously — here's how we protect your data.

Encryption

All traffic is encrypted in transit with TLS. Files and data are encrypted at rest in access-restricted storage.

Isolation

Every piece of data is scoped to your account. Search and the assistant only ever retrieve your documents — retrieval is filtered by your user id inside the database query itself, not by an instruction in a prompt. That distinction matters: a prompt rule is something a cleverly worded message can argue with, and a query filter is not. Retrieved text is also treated as untrusted input, escaped and wrapped so a document cannot issue instructions to the assistant reading it.

Authentication

Sign in with Google or with an email and password (hashed with bcrypt — we never store plaintext). Sessions use signed, short-lived tokens.

AI providers

Content sent to our AI provider is processed to generate your results and is not used to train shared models.

Your assistant's visitors

A published assistant is a public surface, so it has its own boundary. Visitors pass a bot-detection challenge before they can send anything, and the token they get back is short-lived and bound to that specific assistant and that visitor — it cannot be lifted and replayed against another one.

  • The embeddable widget only runs on domains you list. An empty list means our own hosted pages only, never “anywhere”.
  • Public surfaces are read only. A visitor's message can search the knowledge you scoped to that assistant and nothing else — it cannot create, edit or delete anything in your account. The one thing beyond search is an API lookup you have explicitly marked safe for the public, listed on that assistant, and read-only; only the response fields you allow reach the visitor, and each visitor is rate limited.
  • If you turn on visitor verification, a visitor confirms their email with a one-time code before chatting. Codes expire after ten minutes, allow a handful of tries, and lock the address out after repeated wrong guesses. Only a verified visitor can reopen their earlier conversations.
  • Transcripts and the questions asked are kept for a window you choose (7–365 days, 90 by default) and then deleted automatically.
  • An assistant answers only from the space or the specific documents you bound it to, so publishing one does not expose the rest of your vault.

Connections to your own systems

API connectors (Power) let an assistant read from your systems. The credentials you give us are encrypted at rest, bound to the one address you connected, and never sent to a browser — not yours, not a visitor's. Every outbound call is checked so it cannot be pointed at private or internal network addresses, and credentials are dropped if the remote server redirects somewhere else. A sync only removes items after a complete fetch, so a failing API can't empty your knowledge base.

Your controls

  • Export everything at any time, as JSON.
  • Delete any document, or your whole account, permanently — deletion cascades to conversations, assistants and leads.
  • Add a password to a Google account for a second sign-in method.

What we don't do yet

We would rather you find the limits here than a fortnight after paying us. As of today:

  • Reminders go out by email only. SMS, WhatsApp and push are on the roadmap, not in the product.
  • No team or shared accounts.One login, one knowledge base. You can't invite a colleague or share a document with a client.
  • Voice is web voice. Your assistant speaks and listens in a browser. It does not answer a phone number.
  • Booking is Google Calendar only. No Outlook, no Cal.com, no Calendly import.
  • Card payments are live in India today. International card processing is pending gateway approval.
  • We hold no security certifications.Everything above is how the system is built, not the outcome of a third-party audit. We don't claim SOC 2 or ISO 27001 because we don't have them.
  • We are not the only party involved.Your content is processed by our AI provider under a no-training arrangement. We do not run our own model, and we won't pretend your data never leaves our servers.

Report an issue

Found a vulnerability? Please email security@regenticflow.com. We appreciate responsible disclosure.