Security and data handling

Data we access

• Order and fulfilment records

  Required to answer order-status questions accurately.

• Customer contact details

  Name, email, phone and shipping address, limited to resolving conversations to orders.

• Product catalogue data

  Non-personal.

• Conversation content

  The messages the agent reads and the replies it produces, retained so you can audit any auto-sent response.

Controls in place

• Encryption in transit

  TLS for all connections to Reguron and to every platform API we call.

• Read-scoped by default

  Store connections request read scopes. Any write capability is granted separately and can be revoked independently.

• Audit logging

  Every auto-sent message is stored with the data the agent used to generate it.

• Revocable access

  Disconnecting Reguron from your store admin stops data access immediately.

Certifications — current status

We are not going to assert a certification we cannot show you the report for. Here is the honest state of each:

• SOC 2 Type II

  Verification in progress. Marketing copy elsewhere on this site referencing SOC 2 is under review and will be corrected or substantiated. Ask us for the current status before relying on it.

• GDPR

  Data handling is designed around GDPR obligations. A customer-signable DPA and a published sub-processor list are in preparation.

• KVKK

  Relevant to Turkish customers. VERBİS registration status and cross-border transfer basis are being confirmed.

• ISO 27001

  Not held.

Sub-processors

A complete sub-processor list — covering hosting, email delivery, data storage and the language-model providers behind the agents — is being prepared for publication alongside the DPA. If you need it for a vendor review now, email us and we will send the current list directly.

Reporting a vulnerability

Email security concerns to contact@reguron.com with "Security" in the subject line. We will acknowledge receipt and tell you what we are doing about it. Please do not test against production stores belonging to our customers.