Data Processing Agreement
Effective: August 2, 2026 · Version 1.2
Related documents: Privacy Policy, Terms of Service, and Security.
Summary only
This page summarizes RegEngine standard data processing terms for food traceability data that may include personal information.
Executed terms control
Binding commitments are controlled by the DPA, order form, or negotiated agreement signed by your organization and RegEngine.
Personal data may be included
Supplier contacts, employee identifiers, logistics personnel, or other covered data subjects may appear in traceability workflows.
This public page is not a substitute for an executed DPA, order form, or negotiated agreement. It is a diligence summary for standard processor obligations, subprocessors, data subject rights, incident notification, deletion, transfers, audits, and liability boundaries.
1. Definitions
“Controller” means the natural or legal person, public authority, agency, or other body that determines the purposes and means of processing personal data (in this context, the RegEngine customer).
“Processor” means RegEngine LLC, which processes personal data on behalf of the Controller.
“Personal Data” means any information relating to an identified or identifiable natural person, processed by RegEngine on behalf of the Controller in connection with the Services. In the food safety context this may include supplier contact names, employee identifiers on traceability records, and logistics personnel information.
“Traceability Data” means Critical Tracking Events (CTEs), Key Data Elements (KDEs), Traceability Lot Codes (TLCs), and associated supply chain records submitted to RegEngine under FSMA Section 204 compliance workflows.
“Services” means the RegEngine FSMA 204 food traceability compliance platform, including all associated APIs, dashboard surfaces, ingestion pipelines, and export tools.
“Sub-Processor” means any third party engaged by RegEngine to process Personal Data in connection with providing the Services.
“Applicable Data Protection Law” means the EU General Data Protection Regulation (GDPR) 2016/679, the UK GDPR, the California Consumer Privacy Act (CCPA) as amended, and any other data protection legislation applicable to the processing described in this DPA.
2. Roles & Scope
The Controller determines the purposes and means of processing Traceability Data and any Personal Data it submits to the Services. RegEngine acts solely as a Processor: it processes Personal Data only on documented instructions from the Controller and for no other purpose.
This DPA applies to all Personal Data processed by RegEngine on the Controller's behalf through the Services, including data submitted via the dashboard, API, bulk upload, or any automated ingestion workflow.
RegEngine does not determine the business purposes for which Personal Data is processed. The Controller is responsible for ensuring it has a lawful basis to collect and submit Personal Data to RegEngine, and for the accuracy of that data.
3. Processor Obligations
RegEngine's standard processor commitments are intended to include:
- Processing Personal Data on documented customer instructions, unless applicable law requires otherwise.
- Requiring personnel authorized to process Personal Data to follow confidentiality obligations.
- Maintaining the technical and organizational security measures described in Section 6, subject to the executed agreement and current deployment posture.
- Using Sub-Processors under the authorization, notice, and objection process in the executed agreement or signed DPA.
- Assisting the Controller, by appropriate technical and organizational measures, in responding to applicable data subject rights requests.
- Assisting the Controller with security, breach notification, data protection impact assessment, and prior consultation obligations, taking into account the nature of processing and information available to RegEngine.
- Returning or scheduling active-system deletion of Personal Data after the end of Services, subject to legal-retention, backup, immutable-log, and executed-agreement limits.
- Providing available documentation reasonably needed to support DPA verification under the confidentiality, scope, and cost controls in the executed agreement.
- Informing the Controller if RegEngine believes an instruction infringes Applicable Data Protection Law, to the extent required and permitted by law.
4. Sub-Processors
The executed agreement or signed DPA controls subprocessor authorization, notice, objection, and termination rights. The list below summarizes current default and where-configured processors. Default processors support core platform operations; optional processors are used only where the relevant feature, billing flow, analytics flow, object storage, or AI extraction workflow is enabled or configured.
| Sub-Processor | Use | Data Processed | Location |
|---|---|---|---|
| SupabaseDefault platform processor | Authentication for developer-portal accounts and a legacy session-validation path; stores developer-portal API-key records and pre-sales assessment leads. Core tenant workspace data is stored in PostgreSQL managed by Railway. | Developer-portal account records, API-key records, pre-sales assessment leads, and authentication metadata. | United States; project region per executed agreement/current DPA |
| RailwayDefault platform processor | Platform hosting the RegEngine application and the core PostgreSQL database for tenant workspace data. | Workspace records, evidence ledger rows, API requests, application logs, and workflow metadata. | United States |
| VercelDefault platform processor | Frontend hosting, edge delivery, and authenticated request routing. | Authenticated web requests, CDN metadata, and limited edge logs. | United States / global CDN |
| SentryWhere configured | Server, edge, and backend error monitoring with PII scrubbing configured where available. | Error events, stack traces, request metadata, and environment diagnostics. Browser replay capture is not enabled by default. | United States |
| StripeWhere billing is enabled | Billing, invoices, payment processing, and tax support. | Billing contact information, subscription metadata, payment processor tokens, and invoice history. | United States |
| PostHogWhere analytics is enabled | Privacy-conscious product analytics after consent or workspace enablement. | Workspace-scoped product events, pseudonymous identifiers, and consent metadata. | United States |
| ResendWhere email is configured | Transactional email, including invitations, alerts, passwordless sign-in messages, and Supabase Auth delivery (password reset, magic-link, and one-time-code emails) via SMTP where configured. | Recipient email addresses, message metadata, and delivery events. | United States |
| OpenAIWhere AI extraction is enabled | AI-assisted document extraction, OCR enrichment, and classification workflows. | Uploaded document text, label images, and extracted field candidates submitted for enabled AI workflows. | United States / multi-region |
| Google Cloud Vertex AIWhere AI extraction is enabled | Gemini-assisted extraction and classification for configured AI workflows. | Uploaded document text, label images, and extracted field candidates submitted for enabled AI workflows. | United States (us-central1) |
| TypeSafe AIWhere AI CSV suggestions are enabled | Calibrated classification of CSV column headers during CSV ingestion (Jev System One model): which canonical FSMA 204 field an unrecognised column holds, and, for a file that declares no critical tracking event, which one its rows record. | CSV column headers; when the uploader declares a single CTE for the file, that canonical CTE name (for example "shipping"); and, only where sample values are explicitly enabled, PII-redacted sample cell values for unrecognised columns. Never whole rows or files. | United States |
| Cloudflare R2Where object storage is configured | Object storage for uploaded evidence files and generated artifacts. | Raw uploads, normalized JSON, parsed text extracts, and generated artifacts. | United States / global edge |
5. Data Subject Rights
The Controller is responsible for handling data subject requests (rights of access, rectification, erasure, restriction, portability, and objection) received from individuals whose Personal Data is processed through the Services.
RegEngine will, taking into account the nature of the processing, assist the Controller in fulfilling its obligation to respond to such requests. If RegEngine receives a data subject request directly relating to the Controller's data, RegEngine will promptly forward that request to the Controller and will not respond to the data subject directly without the Controller's authorisation, unless required to do so by applicable law.
Access & Portability
Export records through the API, dashboard, or enabled workflow surfaces available to your plan and agreement.
Erasure
Request deletion under your executed agreement. Verified requests are scheduled for active-system deletion; provider backups expire on their normal cycles.
Rectification
Update or correct records through the dashboard. API updates are available to all plans.
6. Technical & Organisational Security Measures
RegEngine implements and maintains the following technical and organisational measures to protect Personal Data processed on behalf of the Controller. These measures reflect the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, as well as the risk of varying likelihood and severity to the rights and freedoms of natural persons.
Encryption at Rest
Customer data is stored with managed provider encryption at rest. Traceability lot data and compliance records are additionally protected by SHA-256 content hashing for integrity verification where evidence workflows create hash manifests.
Encryption in Transit
Data transmitted between customers, the RegEngine platform, and sub-processors is encrypted using modern TLS configurations.
Tenant Isolation
Customer data is isolated using PostgreSQL row-level policies and authenticated tenant context, designed and tested to restrict cross-tenant access on core PostgreSQL-backed paths. Identity-resolution and graph-layer hardening is in active rollout; details available under NDA.
Access Controls
Access to production systems requires multi-factor authentication. Production credentials are stored in secret management systems (never in source control) and rotated on a defined schedule and immediately on any suspicion of exposure.
Personnel
Access to customer data is restricted to the founder-operator under confidentiality obligations; access expands only with contractual controls as the team grows.
Incident Response
RegEngine maintains a documented incident response procedure; security incidents are triaged promptly and affected customers notified without undue delay.
7. Personal Data Breach Notification
Incident Notification Process
RegEngine's standard incident process is designed to notify affected Controllers without undue delay. Where required by applicable law or agreed in the executed agreement or signed DPA, notification will follow the timeline and recipient process stated there.
Any notification will include, to the extent available and appropriate at the time: a description of the nature of the breach; the categories and approximate number of data subjects concerned; the categories and approximate number of personal data records concerned; the likely consequences of the breach; and the measures taken or proposed to address the breach.
Where it is not possible to provide complete information at the time of initial notification, RegEngine expects to provide reasonable updates as information becomes available, subject to confidentiality, security, legal privilege, and scope limits.
RegEngine may provide reasonable incident summaries to affected Controllers where required or agreed, subject to confidentiality, legal privilege, security, and scope limits.
8. Data Deletion & Return
Upon termination or expiry of the Controller's subscription, data return, retention, and deletion windows are controlled by the executed agreement or DPA. RegEngine will make commercially reasonable export assistance available during the applicable return period. After that period, Personal Data and Traceability Data processed on behalf of the Controller are scheduled for deletion from active systems, except to the extent that applicable law, regulatory obligations, dispute preservation, or the executed agreement requires continued storage.
The Controller may request deletion at any time by contacting privacy@regengine.co. RegEngine will process verified deletion requests according to the executed agreement. Provider backups, immutable provider logs, and disaster recovery copies expire according to the applicable provider's normal retention cycle and may not be overwritten immediately.
FSMA 204 Retention Note: FDA regulations require covered entities to maintain traceability records for a minimum of 2 years. RegEngine helps support those workflows, but customers remain responsible for maintaining any independent archives required by their own legal, operational, or regulator-facing obligations.
9. International Data Transfers
RegEngine primarily processes data in the United States. For Controllers in the European Economic Area (EEA), the United Kingdom, or Switzerland, transfers of Personal Data to RegEngine in the United States are handled through the executed agreement, signed DPA, Standard Contractual Clauses (SCCs), UK Addendum, or another approved transfer mechanism where required.
SCCs or a UK Addendum can be executed as part of contracting where required.
Where required for a customer deployment, RegEngine relies on the transfer mechanism set out in the executed DPA or procurement package, which may include SCCs, a UK Addendum/IDTA, or another approved mechanism, depending on the data flow and Sub-Processor.
Controllers who require transfer documentation for their records may request the current execution package by emailing privacy@regengine.co.
10. Audits & Compliance Verification
Audit and verification rights are controlled by the executed agreement or signed DPA. RegEngine's standard diligence process prioritizes written security questionnaires, available policies, control summaries, and completed third-party attestations when available.
Direct system, facility, or personnel audits are available only where required by law or expressly agreed in the executed agreement, and remain subject to confidentiality, security, scope, timing, and cost controls. Formal audit reports, penetration-test summaries, or similar artifacts are provided only if completed and available for the requested review tier.
11. Liability
Each party's liability under this DPA is subject to the limitations and exclusions set out in the RegEngine Terms of Service. Nothing in this DPA is intended to limit either party's liability to data subjects or to supervisory authorities in ways that are not permissible under Applicable Data Protection Law. Where RegEngine is held liable for a data protection violation caused solely by the Controller's instructions, RegEngine may seek indemnification from the Controller to the extent permitted by law.
12. Governing Law & Amendments
The governing law for any binding data processing terms is the law specified in the executed agreement or signed DPA, except where Applicable Data Protection Law requires otherwise.
RegEngine may update this public summary to reflect changes in applicable law, regulatory guidance, or Sub-Processor arrangements. Notice, objection, and acceptance rights for binding DPA changes are controlled by the executed agreement or signed DPA.
13. Contact & Executed Copies
For questions about this public DPA summary, to request an execution package, or to exercise privacy rights, contact: privacy@regengine.co. Customer agreements and DPA redlines should be reviewed by the appropriate business, security, and legal contacts before execution.
RegEngine LLC
Los Angeles, California, United States
Questions about data processing?
Enterprise and design-partner customers can request a DPA execution package, custom data retention schedules, or a security review call. Legal terms require appropriate customer and RegEngine review before execution.