Your firm's data stays in the UK.
Your people stay in charge.
Reglo holds policies, training records, file-review findings and audit evidence for SRA-regulated firms. This page sets out where that data lives, how AI touches it, who can see it, and the assurance we provide.
Stored in the UK
Account content, documents and file-review data live in AWS London (eu-west-2).
AI runs in the UK
Models are reached through Amazon Bedrock in the same region. Your content is never used to train them.
Encrypted throughout
TLS 1.2 or higher on every connection, and encryption at rest.
People approve
AI output is advisory. A named person on your team approves every change.
Where your data lives
One region, one set of rules. The exceptions are listed, not hidden.
The Reglo platform runs on Amazon Web Services in London (eu-west-2). Your account content, the documents you upload and any files processed for a review are stored in that region. Data at rest is encrypted, and every connection uses TLS 1.2 or higher.
Each firm's data is isolated from every other firm's. Backups run regularly and are overwritten on a rolling cycle, so deleted data does not linger.
What sits outside the UK region
A small number of supporting services run elsewhere. None of them holds your policies, files or evidence.
Billing
Stripe processes payments and subscription billing from Ireland and the United States. Card details are handled by Stripe and never stored by Reglo.
Transactional email
Invitations, reminders and notifications are delivered through SendGrid in the United States.
Monitoring and logs
Error monitoring runs on Sentry and application logging on Axiom, both in the European Economic Area.
Single sign-on
Google or Microsoft sign-in is used only where your firm chooses it, and only to authenticate.
How AI touches your data
Reglo uses large language models to read policies against their sources, draft updates with citations, and review files against your checklist. Here is what that means for your content.
In-region inference
Inference runs through Amazon Bedrock inside our UK region. Model providers are accessed in-region, do not receive your content outside that service, and do not use it to train their models. Reglo does not train on it either.
Advisory by design
Nothing becomes a policy version, a submission or a finding without a named person approving it. AI output is labelled as such, and the record shows who accepted or rejected each suggestion.
Grounded in your sources
Drafts are grounded in the regulators and guidance your firm subscribes to, with citations back to them. Nothing is generated without a source to point at.
Scoped file access
When you connect Clio, LEAP or Actionstep, Reglo reads only the files and matters you scope, processes them to produce the review, and does not keep them beyond that purpose. The findings stay in your workspace as your content.
Who can see what
Access is by role, logged, and revocable. The record is the product, so it is built to survive scrutiny.
Inside your firm
Role-based access within the product, so each person sees what their role needs. Each firm's data is isolated from every other firm's.
Inside Reglo
Staff access is least-privilege, protected by multi-factor authentication and audit logged. Network segmentation and secrets management sit behind that, with regular patching, dependency monitoring and vulnerability management.
In the record
Every change, approval and attestation lands in an append-only audit trail. Evidence packs are sealed with a SHA-256 manifest so they can be verified later.
When you leave
On termination, or on your written request, we delete or return your firm's data and delete existing copies, unless the law requires us to keep it. Routine backups are overwritten on a rolling cycle of up to 35 days.
Assurance and certification
We are building towards SOC 2 and ISO 27001. The commitments below are available to every customer today.
Data Processing Agreement
Our standard DPA under UK GDPR Article 28, covering roles, sub-processors, transfers, security measures, deletion and audit.
Read the DPASub-processor list
Every third party that helps run the service, with its purpose and location. At least 30 days' notice before we add or replace one, and a right to object.
See the listSecurity questionnaire
If your due diligence needs more than this page, send us your questionnaire. We complete it and share supporting documentation.
Request documentationAudit rights
The DPA gives you the right to audit on reasonable notice, and we can meet many requests with existing documentation.
Incident response
Documented incident-response and business-continuity procedures. Where a personal data breach is likely to put people at risk, we notify the ICO within 72 hours where required, and affected customers without undue delay.
Vulnerability reporting
Found a security issue? Write to security@useReglo.com. We investigate every report and work with you on responsible disclosure.
security@useReglo.comWe aim for 99.9% monthly availability, with regular backups and documented recovery procedures. We are an early-stage product and do not currently offer contractual service credits. Where a signed agreement includes specific availability commitments, those terms apply.
Facts on this page reviewed 15 September 2026
Questions a COLP, MLRO or IT lead asks first
Where is our data stored?
In Amazon Web Services' London region (eu-west-2). Account content, uploaded documents and file-review data are stored there, encrypted at rest, and every connection uses TLS 1.2 or higher.
Is our content used to train AI models?
No. AI inference runs through Amazon Bedrock inside our UK region. Model providers are accessed in-region, do not receive your content outside that service, and do not use it to train their models. Reglo does not train on it either.
Can Reglo staff see our client files?
Staff access is least-privilege, protected by multi-factor authentication and audit logged. File reviews read only the files and matters you scope, and those files are not kept beyond the review.
What happens to files read from our case management system?
When you connect Clio, LEAP or Actionstep, Reglo processes the scoped files to produce the review and does not retain them beyond that purpose. The findings and evidence stay in your workspace as your content, under your control.
What happens to our data when we leave?
On termination, or on your written request, we delete or return your firm's data and delete existing copies, unless the law requires us to keep it. Routine backups are overwritten on a rolling cycle of up to 35 days.
Are you SOC 2 or ISO 27001 certified?
We are building towards SOC 2 and ISO 27001, and our controls are designed against recognised standards. Today we complete security questionnaires, share supporting documentation, and sign our standard DPA.
What availability do you commit to?
We aim for 99.9% monthly availability, with regular backups and documented recovery procedures. We are an early-stage product and do not currently offer contractual service credits. Where a signed agreement includes specific availability commitments, those terms apply.
What happens if there is a data breach?
We follow documented incident-response procedures. Where a personal data breach is likely to result in a risk to individuals, we notify the Information Commissioner's Office within 72 hours where required, and affected customers without undue delay.
Put your due diligence questions to us directly
Book a demo and bring your IT lead or your consultant. We walk through hosting, AI handling and access controls against your own questions, and follow up with the documentation you need.