How NoxReg protects your data and supports your compliance obligations
Infrastructure
All data stored exclusively in Supabase EU West (Ireland). No data leaves the European Economic Area for storage.
TLS 1.3 for all connections. AES-256 encryption at rest via Supabase's managed PostgreSQL.
Row-level security enforced at the database layer. No employee can access subscriber data without an auditable reason.
Application served via Vercel's enterprise-grade global CDN with DDoS protection and automatic SSL.
AI & Data Processing
NoxReg uses Claude (Anthropic) to classify and summarise regulatory documents. Regulatory document text is sent to Anthropic's API. Anthropic processes data under their Data Processing Agreement. No personal subscriber data is sent to the AI model.
Compliance
NoxReg acts as both Data Controller (for subscriber accounts) and Data Processor (for regulatory content). A Data Processing Agreement (DPA) is available on request for Pro and Enterprise subscribers.
Audit trail logging for AI-generated records. Full generation logs including model version, prompt version, timestamp, and output hash. Available for Enterprise subscribers.
A system description document is available for Pro and Enterprise subscribers to include NoxReg in their Pharmacovigilance System Master File, as required under GVP Module I.
NoxReg complies with Article 50 AI content transparency obligations. All AI-generated content — summaries, importance scores, action recommendations — is clearly labelled as AI-generated.
Documentation
Available for Pro and Enterprise subscribers. We typically respond within 1 business day.
Our security team is available for questions, disclosure reports, and compliance inquiries.
security@noxreg.com