RegulatoryForge self-audits its platform against NIST SP 800-53 Rev 5 controls — the same framework we help you comply with.
RegulatoryForge runs on Google Cloud Platform in a United States region (us-east4, Northern Virginia). Application and database data, including backups, stay with Google Cloud. Traffic reaches the application through a Google Cloud HTTP(S) Load Balancer.
In transit: TLS on every connection, terminated at the Google Cloud Load Balancer.
At rest: Google Cloud encrypts customer content at rest by default, with no action required, generally using AES-256 (Google notes a small number of older persistent disks use AES-128). This covers Compute Engine disks, Cloud Storage and the database backups held there.
Encryption keys are managed by Google Cloud. We do not currently use customer-managed encryption keys (CMEK).
RegulatoryForge collects descriptions of your environment and your controls. It is designed to help you describe your security program — not to store the data that program protects. Do not enter Controlled Unclassified Information (CUI), classified information, or export-controlled technical data (ITAR/EAR). This platform is not assessed or authorized as a CUI enclave and should not be treated as one.
If you believe you have entered such information, contact security@regulatoryforge.com.
Document generation and the AI-assisted analyses use Anthropic’s Claude models. When you use one of those features, the text you submitted for that request is sent to Anthropic for processing and the result is returned to you. Anthropic’s Commercial Terms of Service state that Anthropic may not train models on customer content submitted through the service.
If you prefer not to have content processed this way, the compliance tracker, SPRS estimator and document downloads work without the AI-assisted features.
httpOnly cookies, so page scripts cannot read them.Full detail, including our subprocessors, is in the Privacy Policy.
Every code push triggers automated security scans before deployment. No code ships without passing all checks.
An independent scheduled scan runs daily to catch new vulnerabilities published between deploys.
Python Dependency Scanning
Checks all backend Python packages against the OSV.dev vulnerability database (Google's Open Source Vulnerabilities). Database updates in real-time as new CVEs are published.
Maps to
NIST SP 800-53 Rev 5 RA-5, SI-2
Static Application Security Testing (SAST)
Analyzes Python source code for 40+ vulnerability patterns including SQL injection, command injection, insecure cryptography, and hardcoded secrets.
Maps to
NIST SP 800-53 Rev 5 SA-11, SI-3, CWE-78/89/327
Frontend Dependency Scanning
Scans all JavaScript/TypeScript packages against the GitHub Advisory Database. Updated continuously as new advisories are published.
Maps to
NIST SP 800-53 Rev 5 RA-5, SI-2
| Control | Title | How We Satisfy It |
|---|---|---|
| RA-5 | Vulnerability Monitoring and Scanning | Automated pip-audit and npm audit on every deploy and nightly |
| SI-2 | Flaw Remediation | Scans block deployment; vulnerabilities must be remediated before code ships |
| SA-11 | Developer Testing and Evaluation | Bandit SAST runs on all Python source on every commit |
| SI-3 | Malware Protection | Bandit detects 40+ injection and code execution vulnerability patterns |
| AU-2 | Event Logging | Scan results retained as CI artifacts for 90 days for audit evidence |
We retain scan results as CI artifacts for 90 days, providing auditable evidence for CMMC SI.L2-3.14.1 (Flaw Remediation) assessments.
Self-assessed against NIST SP 800-53 Rev 5 security operations controls
This is our own internal assessment of how we build and operate RegulatoryForge. It is not an independent audit, a certification, or an authorization by any government body.