Security

Last updated: July 29, 2026

Regra is built to hold as little sensitive data as possible and to protect what it does hold.

Payments

All payment flows — checkout, card updates, cancellation — are hosted by Stripe(PCI DSS Level 1). Card numbers are never transmitted to or stored on Regra’s servers.

Authentication

Sign-in is passwordless: magic links to your email or Google sign-in. There are no passwords to leak, reuse, or brute-force.

Data isolation

Every table holding customer data is protected by Postgres row-level security: your session can only ever read your own sites, scans, and findings. Billing state is writable only by our server-side service role — never by a browser session.

Encryption

All traffic is encrypted in transit (TLS). Data is encrypted at rest by our database provider (Supabase).

Scanning

Scans fetch only publicly accessible pages of domains you register — the same pages any visitor sees. We never authenticate into your site and never touch your customers’ data.

Reporting a vulnerability

If you believe you’ve found a security issue, email support@regra.appwith details. We read every report and will respond promptly. Please don’t access data that isn’t yours while demonstrating an issue.