Trust Center

Reglyze is built on Reglyze

We use our own platform to manage Reglyze's NIS2 compliance posture. The data on this page is generated live from our own account — same scoring, same policies, same controls our customers use. No marketing fluff, just our actual numbers.

Last updated: 7 April 2026 at 17:18 • Refreshed hourly from api.reglyze.com/api/public/trust/reglyze

NIS2 Compliance Score

86/100

Organization

Name

Reglyze

Country

Sector

digital_providers

Headcount

NIS2 Status

Out of scope

Reglyze is below the medium enterprise threshold (5 employees, EUR 0.1M turnover) and is not in a NIS2 special category. We comply voluntarily because our customers require evidence of security under their own NIS2 supply chain due diligence (Article 21(2)(d)).

NIS2 Article 21 Controls (21)

Each control is scored on implementation (0-3) and documentation (0-3). Maturity = combined.

21.2.d.1

Supplier relationship securityMature

DPAs signed with all critical vendors. Annual review cadence documented.

Implementation: 2/3Documentation: 3/3

21.2.d.2

Service provider securityMature

Hetzner ISO 27001, Cloudflare ISO 27001/SOC 2, Stripe PCI-DSS Level 1, GitHub SOC 2. Documented.

Implementation: 3/3Documentation: 3/3

21.2.e

Network and information systems securityMature

TLS 1.3 everywhere, container isolation, defense-in-depth. Documented in Information Security Policy.

Implementation: 3/3Documentation: 2/3

21.2.e.1

Vulnerability handling and disclosureMature

Vulnerability Management Policy documented. Dependabot weekly. Public security.txt.

Implementation: 3/3Documentation: 3/3

21.2.f

Cybersecurity risk-management effectiveness assessmentEstablished

Quarterly self-review schedule documented. Compliance score tracked over time.

Implementation: 2/3Documentation: 2/3

21.2.g

Cyber hygiene and trainingEstablished

Cyber hygiene baseline documented for current team.

Implementation: 2/3Documentation: 2/3

21.2.g.1

Basic cyber hygiene practicesMature

MFA, password manager, encrypted devices, no admin local accounts. Documented.

Implementation: 3/3Documentation: 2/3

21.2.h

Cryptography and encryptionMature

Cryptography Policy documented. TLS 1.3, bcrypt, encryption at rest.

Implementation: 3/3Documentation: 3/3

21.2.i

Human resources security and access controlMature

HR Security and Access Control policies documented.

Implementation: 2/3Documentation: 3/3

21.2.i.1

Human resources securityMature

HR Security Policy documented.

Implementation: 2/3Documentation: 3/3

21.2.i.2

Access control policiesMature

App-level RBAC. SSH key-only. Access Control Policy documented.

Implementation: 3/3Documentation: 3/3

21.2.i.3

Asset managementMature

Asset Management Policy documented. Inventory via Hetzner/Cloudflare consoles.

Implementation: 2/3Documentation: 3/3

21.2.j

Multi-factor authentication and secured communicationsMature

MFA on all critical systems. SSH keys only. Documented in Access Control Policy.

Implementation: 3/3Documentation: 3/3

21.2.a

Risk analysis and information system security policiesEstablished

Risk-aware engineering practices documented in Information Security Policy.

Implementation: 2/3Documentation: 2/3

21.2.b

Incident handlingMature

Formal Incident Response Plan documented and approved.

Implementation: 2/3Documentation: 3/3

21.2.c

Business continuity and crisis managementMature

Business Continuity Plan documented covering backup, DR, and crisis management.

Implementation: 2/3Documentation: 3/3

21.2.c.1

Backup managementMature

Hetzner managed daily DB backups, 7-day retention. Documented in Backup/DR plan. Restore tested.

Implementation: 3/3Documentation: 3/3

21.2.c.2

Disaster recoveryMature

DR procedure documented in Backup/DR plan. First restore drill executed.

Implementation: 2/3Documentation: 3/3

21.2.c.3

Crisis managementMature

Crisis comms plan documented in BCP. Founder + emergency contacts defined.

Implementation: 2/3Documentation: 3/3

21.2.d

Supply chain securityMature

5 critical suppliers documented with criticality and data shared. Supply Chain Security Policy in place.

Implementation: 3/3Documentation: 3/3

21.2.g.2

Cybersecurity trainingEstablished

Founder baseline training documented. Will scale on first hire.

Implementation: 2/3Documentation: 2/3

Critical Suppliers (5)

The third parties we depend on. NIS2 Article 21(2)(d) requires organizations to manage supply chain risk.

Hetzner Online GmbH

Cloud infrastructure / hosting

critical

Data shared: All application data, customer accounts, encrypted backups

Cloudflare

CDN, DNS, WAF, TLS termination

critical

Data shared: All HTTP/S traffic metadata, no plaintext payloads

Anthropic

AI/LLM (Claude API for document generation)

high

Data shared: Customer organization context for document generation prompts

Stripe

Payment processing and billing

high

Data shared: Customer billing details, subscription metadata

GitHub

Source code hosting and CI/CD

high

Data shared: Source code, deployment secrets via Actions

Security Policies (10)

All generated by Reglyze itself, tailored to our environment.

Reglyze Cryptography Policy

Updated 7 Apr 2026

Draft

Reglyze Vulnerability Management Policy

Updated 7 Apr 2026

Draft

Reglyze Access Control Policy

Updated 7 Apr 2026

Draft

Reglyze HR Security Policy

Updated 7 Apr 2026

Draft

Reglyze Business Continuity Plan

Updated 7 Apr 2026

Draft

Reglyze Asset Management Policy

Updated 7 Apr 2026

Draft

Reglyze Backup and Disaster Recovery Plan

Updated 7 Apr 2026

Draft

Reglyze Incident Response Plan

Updated 7 Apr 2026

Draft

Reglyze Supply Chain Security Policy

Updated 7 Apr 2026

Draft

Reglyze Information Security Policy

Updated 7 Apr 2026

Draft

Why we publish this

Most compliance vendors talk about security but never show their own posture. We think that's backwards. If our platform is good enough for our customers, it's good enough for us.

Every score, control, supplier, and policy on this page comes from the same Reglyze platform we sell. There's no separate trust portal, no manually-curated security PDF. It's the live data, refreshed hourly via our own public API.

You can verify it yourself: api.reglyze.com/api/public/trust/reglyze

Build your own trust page

Get your NIS2 compliance score, generate policies, and manage suppliers in one platform — the same one we use.