How NoxReg protects your data and supports your compliance obligations
Infrastructure
NoxReg's primary application and database records are stored in Supabase EU West (Ireland). External providers, including OpenAI, may process content depending on the feature and applicable provider/account settings; OpenAI processing and storage have not been verified as EU-only.
TLS 1.3 for all connections. AES-256 encryption at rest via Supabase's managed PostgreSQL.
Row-level security enforced at the database layer. No employee can access subscriber data without an auditable reason.
Application served via Vercel's enterprise-grade global CDN with DDoS protection and automatic SSL.
AI & Data Processing
NoxReg uses OpenAI models for AI-assisted capabilities. Content submitted to AI depends on the feature used; consult the applicable OpenAI API data-processing terms and NoxReg's privacy policy for current details.
Compliance
NoxReg acts as both Data Controller (for subscriber accounts) and Data Processor (for regulatory content). A Data Processing Agreement (DPA) is available on request for Pro and Enterprise subscribers.
Audit trail logging for AI-generated records. Full generation logs including model version, prompt version, timestamp, and output hash. Available for Enterprise subscribers.
A system description document is available for Pro and Enterprise subscribers to include NoxReg in their Pharmacovigilance System Master File, as required under GVP Module I.
NoxReg complies with Article 50 AI content transparency obligations. All AI-generated content — summaries, importance scores, action recommendations — is clearly labelled as AI-generated.
Documentation
Available for Pro and Enterprise subscribers. We typically respond within 1 business day.
Our security team is available for questions, disclosure reports, and compliance inquiries.
security@noxreg.com