Security & Trust Center

What Regresco stores, where it lives, who can reach it and what isn't in place yet.

Last reviewed November 2026

  • Stored in the EUProjects, flows, results, screenshots and traces are stored in Stockholm, Sweden, on Supabase.
  • Encrypted on the way and at restAll traffic uses HTTPS. Supabase encrypts the database and files at rest with AES-256.
  • A fresh browser for each runEach run starts its own Chromium, and each flow gets its own browser context. Internal network addresses are blocked.
  • Not sold, not used for trainingRegresco doesn't sell your data or train models on it. Test runs never call a language model.

Use test accounts and test data

A password typed into a step is stored with the flow, and a Playwright trace records what was typed. A screenshot covers fields named like password or token that the flow typed into, and shows everything else the page showed. Point Regresco at staging, and never give it production credentials.

Your data

Your data stays while your account is active. This is where each part of it lives:

Account
Email, name and plan, in Supabase in Stockholm.
Projects, flows and results
Staging URLs, flow steps, run statuses and step results, in Supabase PostgreSQL in Stockholm (AWS eu-north-1).
Screenshots and traces
A private Supabase Storage bucket in the same project. They open through links signed for one hour, after a check that the run is yours.
Error reports
Stack traces and the page or request involved, in Sentry in Germany.
Server logs
Kept by Railway, the hosting provider, under its retention settings.

Secrets

Everything in the database is encrypted at rest. On top of that, each kind of secret is treated like this:

Your Regresco password
Handled by Supabase Auth. Regresco doesn't store it.
Card details
Handled by Stripe's own checkout and billing pages. They never reach Regresco.
MCP tokens and OAuth tokens
Kept only as a one-way hash (SHA-256). A personal token is shown in full once, when you create it.
Jira API token
Encrypted by Regresco with AES-256-GCM before it's saved.
CI API key
Stored as issued, so each request can be matched to it. Shown in full once, when you generate it. You can replace it at any time.
Bot protection token
Stored as issued. During a run it's sent as a cookie only to your project's own host.
Values typed into flow steps
Stored as typed, so runs can use them, with no encryption beyond the database's own. This is why test accounts matter.

Test runs

  • Each run starts its own Chromium browser, and each flow in it gets its own browser context, so flows don't share cookies or storage.
  • Runs from different customers can use the same worker, each in its own process and browser. There's no separate machine per customer.
  • Localhost, private networks and cloud metadata addresses are blocked when a URL is saved and on every connection during a run, including redirects, images, scripts and WebSockets.
  • The browser in a run can't save downloads and doesn't get the worker's settings or keys, and the worker doesn't run as root. A run has a limit on how much data it can move.
  • Regresco opens your site for a reason you started: a run from the dashboard, a schedule, CI or an agent, AI features that read the page, and a quick check when you add a staging URL.

AI features

  • The model is used only when you ask for it: AI Generate, describing a flow and Explain failure. Test runs and failure labels don't call it.
  • These features send xAI's Grok your staging URL, the structure and visible text of the page, and what you typed. For a failure they send the step, the error message, the page address and the browser's console errors from that step, with the secrets of your flows removed. Whatever is on your staging page can reach the model.
  • xAI says it doesn't train on API inputs or outputs without permission, keeps requests for 30 days for auditing, and doesn't guarantee a processing region on the endpoint Regresco uses.

AI agents (MCP)

  • An agent connects only with a token you create, or after you approve it on Regresco's consent screen. It gets only the permissions you chose.
  • Personal tokens expire after 7 to 365 days, and sign-in access tokens after an hour. Revoking one takes effect on the next request.
  • Password and token fields reach agents as [redacted]. This goes by the field's name, so a password in an oddly named field stays readable.
  • Playwright traces aren't shared with agents, and screenshot links expire after 15 minutes.
  • Agents can't delete projects or flows, and they can't change billing.

The MCP guide has the details.

Access

  • You sign in with an email and password, Google or GitHub, through Supabase Auth. A new account confirms its email address first, and changing a password while signed in asks for the current one.
  • After changing a password, you can turn off your CI key, MCP tokens and connected apps in one step.
  • Each request to the app's API checks who is asking and that the project belongs to them.
  • Row-level security is on for every database table, and browsers have no direct access to the database. The file bucket is private.
  • The site sends HSTS, a Content Security Policy and protection against being framed by other sites.
  • Regresco is built and run by its founder, the only person with access to production.

Backups and deletion

  • Supabase backs up the database daily, and the last 7 days can be restored. Screenshots and traces aren't in those backups.
  • Deleting a project removes its flows, runs, screenshots and traces. Copies in database backups age out within 7 days.
  • To delete your whole account, write to hi@regresco.com. There's no button for this yet. Your data is permanently deleted within 30 days.
  • The privacy policy allows removing screenshots and traces after 90 days to manage storage. No automatic removal runs today.
  • The status page shows the service's current state. There's no uptime guarantee.

Providers

These companies process data on Regresco's behalf:

Supabase
Database, file storage and sign-in.
Stockholm, Sweden
Railway
Hosts the site, the API and the test workers, with their server logs.
Amsterdam, Netherlands
Cloudflare
DNS and the proxy in front of regresco.com.
Cloudflare's global network
xAI
The language model behind the AI features, only when you use them.
No fixed region
Sentry
Error monitoring. A browser error also records a session replay, with all text masked and media blocked.
Germany
Stripe
Payments and invoices on paid plans.
Stripe's regions
Resend
Sign-in emails, run notification emails, contact form messages and a note to Regresco when someone signs up.
Ireland
Plausible
Cookieless page analytics with no personal data.
EU
Google Workspace
Email sent to hi@regresco.com.
Google's regions

Only if you connect them: Jira, your AI clients, and Google or GitHub for sign-in. Each works under its own terms.

Compliance

  • Regresco is operated by Webihooldus OÜ, registered in Estonia (registry code 16567111), so GDPR applies. See the privacy policy and the terms.
  • Regresco has no SOC 2 or ISO 27001 certificate and hasn't had a third-party penetration test. Supabase reports SOC 2 Type 2, but that covers its platform, not Regresco.
  • Need a data processing agreement or a security questionnaire filled in? Write to hi@regresco.com.

Not available yet

  • Two-factor authentication for email and password sign-in. Signing in with Google or GitHub gives you the protection of those accounts.
  • Single sign-on (SSO or SAML), team accounts with roles, and audit logs.
  • A choice of where your data is stored, and your own encryption keys.

Report a problem

Found a security problem? Email hi@regresco.com with the steps to reproduce it. Test only against your own account and leave other people's data alone. There's no bug bounty. The same address is in security.txt.