Protected connections
RegulaCore runs on Cloudflare services. HTTPS protects connections between your browser and our public website and application.
Security at RegulaCore
Security & Trust
Protecting the information behind safer workplaces.
Your safety, quality and workforce records deserve thoughtful protection. RegulaCore combines Cloudflare hosting with account safeguards and workspace permissions to help you control access to your operational data.
- Cloudflare-hosted
- HTTPS connections
- Optional authenticator protection
Product information reviewed October 16, 2026
Clear controls. Practical protection.
Account protection
Enable authenticator-based two-step verification, keep one-use recovery codes and sign out all sessions from your account security settings.
Your workspace. Your permissions.
Tenant-scoped authorization provides logical separation between customer workspaces. Access follows the user’s role, enabled modules and configured permissions.
Traceable workflow records
Applicable workflows retain activity history, decisions and supporting evidence so your team can review what was recorded and by whom.
Here to answer your questions
Confidence starts with a conversation.
Evaluating RegulaCore for your organization? Send us your security questionnaire. We’ll discuss the controls, configuration and available evidence relevant to the modules you plan to use.
Access & identity
Account protection, team roles and workspace permissions.
Data & operations
Hosting, data flows and your retention and recovery requirements.
Evidence & review
Relevant validation results and your procurement questions.
Security questions, answered
How can I add protection to my account?
Open Profile > Security to set up an authenticator and save your one-use recovery codes. Two-step verification is optional per account, not automatically enabled for every user. You can also sign out all sessions.
RegulaCore queues email notices when authenticator protection is enabled or disabled, or all sessions are revoked. Notices are sent to the account email and RegulaCore’s security contact; temporary delivery failures are retried.
Does RegulaCore have a SOC 2 report or ISO/IEC 27001 certification?
No independent SOC 2 Type II report or ISO/IEC 27001 certificate is currently available for RegulaCore. We do not claim SOC 2 attestation. We do not claim ISO/IEC 27001 certification.
Cloudflare hosting does not confer these credentials on RegulaCore. Our ISO toolkits support customers’ own implementation and audit preparation; purchasing or using them does not certify RegulaCore or the customer.
Where is RegulaCore hosted, and how is tenant data separated?
The application uses Cloudflare services, including Workers, D1, KV and R2. Tenant context and application authorization provide logical separation, rather than a physically dedicated database for every customer. Confirm data flows, processors and any residency requirements for your proposed configuration.
How are mobile and offline incident reports handled?
The incident workspace must be prepared while connected. It can then keep encrypted drafts and evidence on the device behind a separate passphrase. Local records may remain after submission. Sync requires the workspace to be open, unlocked, connected and signed in; confirm report and attachment receipts before clearing browser data.
Browser storage can be cleared or evicted. Use trusted devices and screen locks, and plan for lost devices and unsynced work. Offline reporting is not emergency dispatch.
What backup and recovery information can we review?
Quality evidence recovery has been exercised in isolated restore and integrity tests, including missing or corrupt originals and unauthorized recovery attempts. These are product validation checks, not an independent security attestation.
Review backup coverage and recovery requirements for the specific modules your organization will use.
How do we agree service and regulatory requirements?
Confirm availability, backup coverage, recovery objectives, support response, retention, deletion and incident-notification terms in your written agreement. There is no universal uptime percentage, recovery time or notification deadline promised by this page.
Software features and templates support your work but do not establish regulatory compliance or guarantee an audit outcome. Confirm regulated-data use and any required HIPAA business associate agreement in writing before use.
Talk to our security team
For security questions or vulnerability reports, email admin@regulacore.com. Include the affected page, time, impact and minimal reproduction steps. Please do not send passwords, production credentials or unnecessary personal data.
Privacy Policy · Data Processing Agreement · Terms of Service
This informational page does not amend an executed agreement. For commercial questions, contact sales@regulacore.com.