Built to control who can see, decide and act.
RegNexus Books protects your financial data with layered controls — and proves its own control posture continuously, rather than asking you to take it on trust.
Layered protection for your financial data.
Encryption in transit
All connections secured with TLS 1.3. HSTS enforced across all endpoints.
Encryption at rest
Sensitive data (HMRC OAuth tokens, API keys) encrypted with AES-256-GCM before storage.
Tenant isolation & RBAC
Strict role-based access with multi-tenant isolation — users only access their organisation's data.
Audit logging
Significant actions (logins, data changes, submissions) logged with timestamp and actor identity.
Four-eyes & materiality
Approval gates and materiality controls built into execution, not bolted on after.
Dependency management
Automated vulnerability scanning of third-party packages with prompt patching.
Found a vulnerability? Tell us.
Email security@reg-nexus.com with steps to reproduce, affected endpoints and supporting evidence. Please don't publicly disclose until we've had a reasonable opportunity to investigate and remediate.
Acknowledgement
Within 48 hours of receipt.
Investigation
Initial assessment within 5 business days, with updates until resolved.
Good-faith safe harbour
We won't take legal action against researchers acting in good faith under this policy.
If the worst happens, we act fast — and by the book.
In the event of a confirmed breach involving personal data, RegNexus Limited will: notify the ICO within 72 hours (UK GDPR Art. 33); notify HMRC where tax data or MTD credentials are involved; inform affected users without undue delay; and conduct root-cause analysis with remedial measures to prevent recurrence.
RegNexus Limited · Company no. 17280006 · Security enquiries: security@reg-nexus.com · See also our Privacy Notice.
Don't take our claims on trust.
Our controls are certified continuously — see the live status on the homepage.
View live certification →