How ReQL protects your documents and compliance data.

Yes. Documents are transferred over an encrypted connection and remain encrypted in storage within the selected deployment environment.

Access is limited to the users you invite, according to the roles and permissions assigned in your workspace. ReQL personnel access is restricted to support and operational work you request.

Each customer works within its own workspace, and documents and findings are scoped to that workspace. On self-hosted deployments, separation is provided by your own environment.

On ReQL Cloud, data is hosted in the region agreed for your workspace. On a self-hosted deployment, data stays in your own VPC or private cloud.

ReQL's review programme covers three areas. All three are currently in progress; we publish reviewer, date and outcome only once the corresponding report is available.

• Code audit — source code, dependencies and configuration. Status: in progress.
• Application security audit — authentication, access controls, APIs, session handling and workspace separation. Status: in progress.
• DPDP consent audit — consent notices, capture and withdrawal flows, stated purposes and retention practices. Status: in progress.

Reports or summaries are not published yet. We do not describe ReQL as independently audited, certified or DPDP compliant until a report supports it.

Credentials and secrets are held in managed secret storage rather than in application code. On ReQL Cloud, keys are managed by ReQL. On a self-hosted deployment, keys and logs remain under your own controls.

Retention follows the settings agreed for your workspace. On request or at the end of the agreed term, data is removed through the documented deletion process, which includes removal from backups within the applicable timeline. Specific timelines are confirmed in your agreement.

You can export your documents, findings and review history from the workspace, so your records remain available to you independently of ReQL.