Specific about the boundary - careful about the claim.
Early-access boundary
The marketing site demonstrates an early-access product using synthetic data. It is not a production customer-data environment, and visible fixture labels remain part of the product boundary.
Human authority
AI-assisted output is non-authoritative by design. Drafting, mapping, and flags enter a human review process; named people retain approval and export authority.
Certification evidence
Cybercontrols.io Ltd holds ISO/IEC 27001 certification. RegAtlas is developed with ISO/IEC 27001 and ISO/IEC 42001 controls in view; no ISO/IEC 42001 certification or product-certification claim is made here.
Development discipline
The codebase uses type checks, automated tests, linting, and boundary checks. Release evidence should remain tied to the reviewed source revision.
Responsible disclosure
Report a suspected security issue to contact@regatlas.eu. Do not include exploit code or sensitive third-party data in the first message.
Evaluation requests
Deployment, subprocessor, assurance, and certification-scope details are shared after review for the specific product and legal entity. RegAtlas remains human-governed, and certification does not transfer regulatory accountability or certify customer outcomes.