Data handling & what’s built
Two honest answers in one place: exactly what can leave your machine (and what never can), and what Regixo does today versus what is still on the roadmap. If a capability is designed but not built, it is on this page — never dressed up as shipped.
What leaves your machine, and what never does
Regixo is local-first. Reading your catalog, drafting the RoPA and DORA register, correcting a
flag, wiring an agent — all of it happens on your machine with nothing sent anywhere. The one time
data leaves is regixo invite, and only metadata, and only after you confirm a
preview of exactly what will go.
| Data | Can it leave? | Notes |
|---|---|---|
| Table & column names | Only on regixo invite, after you confirm | The map’s structure — what the compliance team needs to draft the record. |
| Data types & nullability | Only on regixo invite, after you confirm | Read from information_schema. |
| Owners & row-count estimates | Only on regixo invite, after you confirm | The DB role and the planner’s estimate (~N rows), never a COUNT(*). |
| Lineage edges | Only on regixo invite, after you confirm | Relation-to-relation flows, never SQL text. |
| Personal-data flags | Only on regixo invite, after you confirm | The classifier’s output — which columns look like personal data, and the kind. |
| Raw row values | Never | Hard Rule #2. The scanner reads metadata only — it never runs SELECT *, never counts rows, never reads a value. No sampling connector is even built. |
| Secrets / connection strings | Never | Only the env-var name (connectionRef) lives in regixo.yml; the secret stays in your environment. |
regixo invite prints a preview of what will leave the machine first, then asks
for a [Y/n]. Headless runs need --yes to consent — otherwise a coded
UPLOAD_NOT_CONFIRMED error, never a silent upload. regixo invite --no-upload
stays fully local, zero network.Encryption at rest
Metadata is treated as confidential throughout — a table named patients_oncology
leaks on its own. At-rest protection differs by side:
| Control | Free (local store) | Paid (portal) |
|---|---|---|
| Encryption at rest | OS-level disk encryption + owner-only file permissions (0700 data dir, 0600 index.db) | Per-tenant keys (AES-256-GCM), mandatory |
| Tenant isolation | n/a — single machine | Per-tenant keys and DB isolation |
Enforced-mandatory encryption is a cloud-launch gate; per-tenant DB isolation has shipped in part (a control-plane / per-tenant database split) and stays a launch gate until it is complete. The hosted portal is not yet live (see the roadmap table below).
Secrets
Secrets never live in regixo.yml. Each source names the environment variable that
carries its connection string (connectionRef); Regixo resolves the value from your
environment at scan time. Commit regixo.yml freely — it holds only variable names and
non-secret config.
What’s built, and what’s on the roadmap
Regixo is a real product with real edges. The table states each capability’s status plainly, so nothing here promises more than the software does.
| Area | Status |
|---|---|
| Connectors | |
| SQL family (Postgres, Redshift, MySQL, SQL Server), Stripe, manual CSV, dbt lineage | built Seven of the ten native source kinds that ship today. |
| Snowflake, BigQuery | built Two more native kinds — metadata-only, read over their REST APIs (schema, never row values). Honest caveat: neither has yet been run against a live account (fixture, stubbed-transport and gated-live tests only), so treat first-run reliability as unproven. |
Bring your own connector (script) | built The tenth kind — for any source Regixo doesn’t ship. regixo connectors new <name> scaffolds a generator an AI agent completes; regixo add script --generator <path> --ref <ENV> wires it in. Runs out-of-process, metadata-only. |
| HubSpot, Salesforce, Google Workspace, S3/GCS/Azure Blob, OpenAPI/JSON-schema import | roadmap No built-in connector yet — the docs say "roadmap", never "supported". For any of these today, bring your own with the script connector above. |
| Reaching a locked-down database | built Bring your own VPN/SSH tunnel, run inside the network, or describe it by CSV. There is no --tunnel flag. |
| Manual import | built CSV only (header dataset,column[,type,nullable]). There is no --from schema.json. |
| The catalog & classifier | |
| Auto row-estimates & automatic view→table lineage | built Postgres/Redshift only (from pg_class/pg_depend). MySQL and SQL Server give tables, columns and types, but no auto estimates or lineage. |
| PII classifier recall | built Benchmarked and passing for EN/DE/FR/NL. Other languages (ES/IT/PT/PL/SV/DA/RO) have terms but unmeasured recall — treat as best-effort. |
| Activity grouping & record language | built Rule-based grouping only — no AI/LLM. Records render in English today. |
| The record & the seal | |
| RoPA legal fields (purpose, lawful basis, retention…) | built Regixo suggests; only a named human confirms or signs. No CLI, agent, or import can confirm on your behalf (Hard Rule #4). |
| DORA DRAFT register | built Fully usable — draft, fill, import CSV, check status. |
DORA official export (regixo dora export) | paid gated Refuses today: the EBA taxonomy/DPM constants ship empty pending owner verification. The DRAFT register is fully usable now; the sealed filing package is a later gate. |
| The seal | paid A simple electronic signature over the exact record bytes — offline-verifiable and portable. Under eIDAS (Art. 25(1)) it cannot be denied legal effect solely because it is electronic; it is not a qualified electronic signature. |
| RFC 3161 time counter-stamp | pending The mechanism ships, but no time-stamp authority is configured yet, so seals record timestampProof: none until the owner selects a TSA. |
| The compliance portal, hosting & distribution | |
| Compliance portal — claim a forwarded draft, fill the legal calls, unlock, sign & seal, team & roles | built The forwardable DRAFT PDF and claim link work today; claiming, filling, and signing are built and verified. Reading and filling are free; signing is the paid step. |
Public hosting at app.regixo.com — multi-tenant, live card payment (Stripe), real-IdP SSO, per-tenant DB isolation, regixo serve self-host | launch gate Wired and offline-tested, not yet switched on. The portal runs today in dev; per-tenant DB isolation has shipped in part (a control-plane / per-tenant database split) and remains a launch gate until complete, alongside EU-hosted live payment. |
| Install | built pre-1.0 npx regixo start works today — pre-release 0.1.x builds publish to npm (latest 0.1.16). Regixo has not launched yet; the 1.0 release is still ahead. |
PORTAL_NOT_INSTALLED instead of producing an official artifact.