One record, two people. The engineer forwards a draft from the command line; the compliance team fills and signs it in the browser; then the engineer pulls the filled cells and the finished seal back home. This is that full round-trip, so the sealed evidence ends up next to the systems it describes.
“Forward my Regixo draft record to our compliance team. Show me what would be uploaded before you send it.”
$ regixo inviteIt previews what leaves the machine and waits. The full names of the 14 tables that look like they hold personal data, the kinds of personal data derived from your column names, the drafted record — and never a column name, a column type, or a row value.
Check it worked: a DRAFT PDF you can email and a claim link. Your agent must show you the
preview and get your word — off a terminal regixo invite needs
--yes, and the playbook tells it to get that agreement in words first, never to assume
it.
About to upload the draft snapshot to https://app.regixo.com (this is the
DEFAULT — it leaves your machine).
what leaves the machine: The full name of the 14 tables that look like they
hold personal data — source, schema and table. Per activity, the kinds of
personal data the classifier derived from your column names (“Email”, “Name”)
— never a column name itself. The drafted record: activity titles and Regixo’s
suggested legal fields. Everything else is a count, not a name: 6 sources,
22 datasets, 41 columns that look like personal data. It is metadata only:
no column names, no column types, no row values, ever.
(answer n, or re-run with --no-upload, to stay fully local — zero network.)
Upload it? [Y/n] y
catalog shipped: app-db, dbt, hubspot, script, stripe, warehouse · last scanned 0d ago (2026-07-05)
This forwards a copy of your one compliance record — forward it to your
compliance team (no account needed from you):
DRAFT PDF: .regixo/invite/RoPA_DRAFT.pdf (forward it today — it carries the claim link)
claim link: https://app.regixo.com/claim/clm_7Q… (uploaded — this link now works;
your compliance team opens it and unlocks there)
coverage: 6 of 6 sources readregixo invite).What you send: two things that carry the same metadata-only payload — a DRAFT PDF
written on your machine, and a claim link whose snapshot uploads to the compliance portal’s
default host, app.regixo.com. That payload is the full paths of the tables that
look personal, the kinds of personal data (categories, never a column name), the drafted record
and your org name, and the recipient address only if you typed one. Everything else is a count, not a
name — no column name, no column type, no row value, ever. What they receive: nothing to install
and no account to create — they open the link and read. It lands them on a finished-looking record
built from their own systems, not a blank form, with your part already filled and the gaps marked.
What it costs them: reading and filling are free; a price appears only at sign —
€6,000/year for the RoPA, €12,000/year with DORA, from €18,000 for larger orgs,
published, never “ask us”.
--dry-run first to preview.“Pull the answers our compliance team filled in on the forwarded link back into my local Regixo catalog.”
$ regixo pull clm_7Q…
Their answers, merged into your local draft. A field they confirmed stays confirmed — it is carried, never re-derived.
Check it worked: it reports how many merged and how many were skipped (already
merged, or your local copy is newer). If it says anything else, check for yourself with
regixo dora status.
B_05.01/stripe/lei: “” → “5493001KJTIIGC8Y1R12” (claim-side 2026-07-04 09:12) B_02.01/contract-88/expiryDate: “” → “2027-03-31” (claim-side 2026-07-04 09:15) ✓ merged 2 fills from claim clm_7Q… · 3 skipped (already merged or local is newer). ↳ see them: regixo dora status · regixo annotate list
regixo seal pull
<claim-token>. It fetches the signed artifacts — the sealed PDF, the record JSON, the
attestation, and the offline verifier — into your local data directory.“Pull our signed, sealed record from the portal onto this machine.”
$ regixo seal pull clm_7Q…
The sealed record comes home — the official PDF, the record and the attestation, next to the source they describe.
Check it worked: it names who signed and when. Not signed yet? It says so and changes nothing.
✓ pulled 4 of 4 sealed artifacts → .regixo/remote-seal signed & sealed by Dana Kessler (Data Protection Officer, Acme Europe BV) on 2026-07-05 · plan ropa verify offline: node .regixo/remote-seal/verify-attestation.mjs
RoPA_OFFICIAL.pdf, RoPA_OFFICIAL.json, attestation.json and
verify-attestation.mjs. You can check the seal with no Regixo server in the loop.After they pay: the licence activates on the record and an approver signs — both acts happen
in the portal, under a named person. How the buyer gets the file: the sealed official PDF
downloads straight from the portal (↓ Download the official PDF), no tools needed.
Who runs the export back home: you do — regixo seal pull brings the sealed artifacts
onto this machine, and the DORA official export is produced on your host with
regixo dora export — the machine that holds the source. It never runs on the claim, so the
regulator-grade file is assembled where the data lives, not in the cloud.
regixo open, look at the Record screen — the same GDPR Article 30
record you forwarded, still derived from the map, still stamped DRAFT until a person signs it.
The screen below is that record before the round-trip closes: the coverage line, the fact rows,
and the blanks split between your part and your compliance team’s. Once regixo seal pull has
brought the signature home, this same screen carries the seal and the hand-off card reports it was
signed, rather than merely forwarded.Where this stands
Suggested values aren’t counted here — each one is confirmed on its own row. The seal never confirms a legal call for you.
GDPR · Art. 30 · drafted from the sources you configure — metadata only, never row values
A plain list of every way your company uses people’s personal data — drafted from the sources you configure. EU law (GDPR Art. 30) makes most companies keep one. Each entry is an activity: your datasets, grouped by the job they serve.
8 records · 8 named · 8 with open calls
↓ Download the sealed PDF serves it right
from the host.--dry-run to preview. And the DORA
official export always stays on the engineer's host — the machine that holds the source — never
on the claim.