Security controls with explicit pilot boundaries

Current controls

• HTTPS, HSTS, Content Security Policy, clickjacking protection, restrictive browser permissions, and private-route noindex headers.
• One-way password hashing, secure session cookies, origin checks, request throttling, and workspace role separation.
• Private upload credentials with file type, size, signature, and malware checks before OCR.
• MariaDB persistence, versioned assessment snapshots, checksum-verified operational backups, and readiness monitoring.
• The application runs under a dedicated operating-system account and private loopback port behind an isolated Nginx site configuration.
• Operational metrics exclude label text, claims, ingredients, email addresses, and filenames.

Current limitations

• The free pilot has not received an independent security certification or penetration test.
• Operational backups currently remain with the hosting environment; independent off-site recovery is not verified.
• Production email delivery, payment processing, advertising analytics, and third-party AI processing are disabled.
• Automated regulatory coverage is preliminary and has not received external legal or regulatory approval.

Data flow

Label files pass through file-type, size, signature, and malware gates before extraction. OCR runs on the ReguPrep application server. Extracted text remains tied to source evidence so users can confirm product facts before assessment. Confirmed facts, rule versions, findings, and reports remain separated by workspace.

Browser-only checklist tools do not submit their entries to the server. The assessment workflow sends the facts and files needed to run the selected check.

User-side safeguards

• Upload only current product artwork needed for the selected review.
• Remove unrelated personal, medical, payment, or trade-secret information.
• Verify the product version and extracted facts before running a check.
• Delete test records when they are no longer needed.
• Report suspected exposure or unexpected access before continuing to use the service.