Built
Tenant identity from authentication
Tenancy is derived from the credential that authenticated the call. There is no tenant identifier in the request body to spoof, and no cross-tenant read path in the decision runtime.
Trust
Trust & data handling.
Compliance-first architecture, stated as architecture. This page separates what is built from what is not, because the difference is the whole point of buying a governance layer.
No SOC 2 / ISO 27001 / HIPAA certification claimed today.
Regent holds no security or privacy certification at this time. Nothing on this site should be read as certified, accredited, or equivalent to a certification. When a certification exists it will be named here with its scope and date, and not before. UniversalHealthCare.ai is tenant #1 for the controlled trial. First governed traffic is running. Pilot cohort is open.
Section 1 · built
Architectural controls that exist today.
These are properties of how the system is built, not policies someone promised to follow.
Built
Raw recipient outside the judgment runtime
The decision dossier the judgment engine sees and the delivery envelope that carries the address are separate objects. Raw recipient addresses never enter the judgment runtime; the dispatch audit row records the address as asserted by the tenant against a specific request.
Built
Secret separation
Channel credentials, app secrets, provider tokens and tenant API tokens live in the vault. The judgment layer holds no credentials, no raw identifiers and no cross-run state.
Built
A deterministic gate layer
The rules that stop a send are pure logic with no IO. They are not a prompt, they are not advisory, and the model cannot argue with them.
Built
Idempotency
A repeated request id with the same content returns the original operation and never acts twice. The guarantee is zero duplicate dispatch authorizations.
Built
Provider-unknown honesty
When the provider send response is lost, no provider-backed correlation exists. Matching on recipient and timestamp is a heuristic that can support investigation, and it never establishes acceptance. The state stays unknown until a provider-supported identifier resolves it, or an operator resolves it manually.
Built
Tamper-evident audit with governed redaction
Append-only and hash-chained with signed checkpoints and an integrity-verification path. Governed redaction and deletion tombstones are part of the model, which is why the property is tamper-evident rather than immutable.
Built
Synthetic and de-identified pre-contract evaluation
Pre-contract evaluation runs against public website context and fabricated personas. The Guided Eval reads a public website server-side, requires no production integration and no real customer data, and dispatches nothing; any legal or procurement paperwork required by either party is handled separately.
When a crisis flag is present in the accepted request context, the pre-agent hard stop resolves the escalation before the judgment engine is invoked. No outreach is proposed, none is sent, and the named escalation path executes. Non-overridable at decision time. There is no operator bypass.
Section 2 · required before the first live tenant
The pre-launch floor.
A short, specific list that gates the first live tenant. It is not shipped yet, and this page will say so until it is.
Not shipped yet
Named-operator-only workspace access
Access to the judgment workspace restricted to named operators, not a shared team login.
Not shipped yet
A hard retention cap with a deletion job
A scheduled deletion job enforcing a hard cap on workflow-run log retention, so the secondary store is bounded rather than indefinite.
Section 3 · parallel during the trial
What is being built while the first tenants run.
This work runs alongside the trial rather than gating its start. Each item is named so a buyer can ask about it specifically.
In the trial workstream
Trace payload minimisation
Reducing what the trace carries to what the evidence model actually needs.
In the trial workstream
Offboarding deletion
Deletion across the engine, the judgment workspace and backups when a tenant leaves.
In the trial workstream
Data-flow register
A written register of what data moves where, for whom, and under what basis.
In the trial workstream
Incident and credential basics
Incident handling and credential-revocation procedure, written down and exercised.
In the trial workstream
Trial-window sweep
Every trial tenant’s live start date is recorded. When the playbook lands, all data created during the trial window is audited and then deleted or redacted per that playbook. The trial period is a labelled window with a scheduled cleanup, not an open-ended hold.
Section 4 · after
Legal, residency and certification work.
Committed as scope. The timing is a deliberate decision, not an oversight — and stating it plainly is more useful to a compliance officer than a certification badge that does not exist.
Later workstream
Jurisdictional legal validation
Reviewed with specialists per market rather than asserted from a template.
Later workstream
Residency and hosting
Where data rests, decided with the same specialists.
Later workstream
DPA library
Processing agreements as documents a counsel can actually sign.
Later workstream
Certifications
Pursued when the controls behind them exist and can be evidenced. Not before.
Later workstream
Retention matrix and privacy assessments
Formalised once the register and the deletion machinery are in place.
Evaluation
You can evaluate Regent without giving it anything.
Pre-contract evaluation runs on synthetic or de-identified data only. That is not a concession — it is how the evaluation is designed.
- The public Guided Eval on this site reads a public website through a hardened server-side boundary, compiles a temporary evaluation profile, and runs fabricated personas through the real governed chain. Every action terminates in a simulation sink: it sends nothing, to anyone, on any channel.
- The Governance Playground in the demo console is separate and fully synthetic — pre-authored fixtures and local deterministic rules, with no website read and no model call.
- The demo console is a public product tour over the same fixtures. There is no login, no session and no tenant credential in the page.
- A Guided Eval with the pilot owner uses synthetic personas matched to your user profile. It requires no real customer data or production integration; any legal or procurement paperwork required by either party is handled separately.
- Real data arrives later, under an agreement, on your terms.
Questions a compliance officer should ask
Ask them before the pilot, not after.
Where the answer is "not yet", this page says "not yet". Bring the rest to the pilot conversation — the named technical owner and the named escalation owner are part of how a pilot starts.