Skip to content
REGOR

Trust & Transparency

Inside your search. Never out of your control.

Regor interprets shopper requests inside your storefront search and changes nothing in your store on its own. Every interpretation is logged, every capability is allow-listed, and you can switch a pilot off at any time. Your data is encrypted, minimized, and never sold. This page documents exactly how, with the full detail in our Governance and Privacy pages.

Last updated: September 22, 2026

  • Security

    Encryption in transit and at rest, least-privilege access, and signed webhooks across every endpoint.

  • Privacy & data

    We collect the minimum needed to run conversational search. No card data, no shopper PII, no training on your data.

  • Governance & control

    Off by default, enabled per pilot. Only the capabilities you allow-list are applied, every interpretation is logged, and you can switch a pilot off at any time.

  • Compliance

    GDPR and CCPA/CPRA aligned today, with SOC 2 Type II in progress.

Controls

The safeguards behind every interpretation

  • Encryption

    • Data is encrypted in transit, and sensitive credentials are encrypted before storage
    • Merchant API keys encrypted before storage. Raw keys are never persisted
    • Outbound webhooks signed with per-merchant secrets

  • Authentication & access

    • Role-based access control with distinct Admin, Merchant, and API roles
    • Short-lived session tokens and securely hashed passwords
    • Principle of least privilege on every role
    • Key-based SSH only. Password login disabled

  • Infrastructure

    • Public production traffic is encrypted in transit
    • Managed DDoS protection and a WAF on all public endpoints
    • Firewall restricts inbound access to HTTPS and key-based SSH
    • Separate development and production environments and secrets

  • Application security

    • Request validation on API endpoints
    • Parameterized database operations reduce SQL injection risk
    • Rendered text is encoded to reduce script injection risk
    • Security headers include X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy

  • Runtime safety

    • Off by default. Native search runs only for the pilots you explicitly enable
    • Allow-listed capabilities. Only the attributes, ranges and sorts you configure can be applied
    • Unmapped requests stay unapplied. A request Regor cannot map to an enabled refinement changes nothing for the shopper
    • Daily interpretation call caps per merchant and a health-check halt for interpretation runs
    • Every interpretation is logged, and Regor writes nothing to your catalog, prices, or theme

  • Data handling

    • We collect search events, shopper requests for interpretation, catalog attributes, and account details only
    • No card data, no shopper PII, raw IP addresses hashed before storage
    • Your data is never sold and never used to train shared models
    • Export your data in JSON or CSV, and delete it on request

Compliance

Where we stand today

We show our real status, not badges we have not earned. SOC 2 Type II is in active preparation rather than complete.

  • GDPRActiveDPA available. Data minimization, purpose limitation, and deletion rights implemented.
  • CCPA / CPRAActiveAccess, deletion, and opt-out supported for consumers.
  • SOC 2 Type IIIn progressControls preparation is in progress. No attestation date is committed.
  • ISO 27001PlannedNo target date is committed.
  • PCI DSSNot applicableNo card data processed. Payments handled by Stripe.

Incident response

We detect, triage promptly, contain, and notify affected customers within 72 hours of a confirmed incident, in line with GDPR. Every incident closes with a documented post-mortem covering root cause and preventive measures. Report a concern or a vulnerability to security@regor.ai.

Security documentation on request

Our detailed security overview and a completed assessment questionnaire are available to customers and prospects under NDA. For a signed DPA or a custom security review, reach out and we will turn it around quickly.

Request security documentation

Give shoppers search that understands.

See how shoppers can describe what they want and refine their results in your existing search bar.

Book a demo