Security

Security Effective Date: September 29, 2026 We protect the personal data you trust us with using technical and organisational measures that fit the risk. This page summarises them. It forms part of our Data Processing Addendum. Hosting and network Data is stored in London. All traffic uses HTTPS and we set HSTS and a Content Security Policy on our sites. Access control Every brand's data is separated using row-level security in the database. People only see the brands they belong to, with roles (owner, admin, editor, viewer) that limit what they can change. Staff access to production is restricted to those who need it. Secrets and keys Third-party credentials such as connected ad accounts and messaging keys are encrypted at rest. API keys for registration forms are stored only as one-way hashes and are shown once when created. Webhook signing secrets are never shown back to readers. Abuse and misuse protection Public forms use rate limiting, hidden-field bot traps, per-person attempt limits and optional Cloudflare Turnstile. Uploads are checked for type and size. Messaging includes opt-out handling, suppression lists and, for US text messages, quiet hours. Data minimisation and retention Visitor IP addresses are cleared after 30 days, registrant IP addresses and browser details after 90 days, webhook message bodies after 30 days and error logs after 90 days. Incidents If we become aware of a personal data breach affecting your data, we will tell you without undue delay and, for organisers, within 48 hours of confirming it, with the information you need to meet your own reporting duties. Reporting a vulnerability Please email hello@reggi.ee with details. We will acknowledge within 3 working days. Please give us a reasonable time to fix an issue before you disclose it, and do not access other people's data.