{"version":1,"environment":"gcp","sections":{"residency":{"verifiedAt":"2026-09-14T19:18:52Z","basis":"configured","source":"infra/chart/values-gcp.yaml","check":"the residency labels every resource carries","resources":[{"class":"database","region":"europe-west3","zone":"europe-west3","customerData":"none"},{"class":"database volume","region":"europe-west3","zone":"europe-west3","customerData":"none"},{"class":"compute","region":"europe-west3","zone":"europe-west3","customerData":"none"}],"zones":[],"backup":null},"egress":{"verifiedAt":"2026-09-08","basis":"reviewed","source":"infra/chart/trust/egress-allowlist.yaml","check":"the reviewed allow-list","allow":[{"host":"api.github.com","purpose":"The GitHub App's requests: the installation, the repositories it can see, their pull requests, and a review or comment a person writes in Regbuild","data":"Repository names, pull request numbers and the words a person chose to post; never a key or a token of the workspace"},{"host":"github.com","purpose":"Exchanging a person's authorisation code for their token; the installation and authorisation pages are GitHub's own, opened by the browser","data":"The authorisation code and the App's client credentials, nothing else"}]},"subProcessors":{"verifiedAt":"2026-09-10","basis":"reviewed","source":"infra/chart/trust/sub-processors.yaml","check":"the reviewed list","list":[{"name":"Google Cloud","role":"Build and staging infrastructure","location":"europe-west3 (Frankfurt)","dataClass":"No customer data, ever; seed data only (DR-05)","noticeDays":"30","noticeFrom":"2026-09-06","holds":"yes"},{"name":"OVHcloud","role":"Production hosting, planned","location":"eu-west-par (Paris)","dataClass":"Customer data, once production exists (DR-05, DR-14)","noticeDays":"30","noticeFrom":"2026-09-06","holds":"no"}]},"topology":{"verifiedAt":"2026-09-14T19:18:52Z","basis":"configured","source":"infra/chart/values-gcp.yaml","check":"the chart values","environment":"gcp","exposure":"Ingress","replicas":1,"database":"PostgreSQL in the cluster, one StatefulSet with a persistent volume"},"inference":{"verifiedAt":"2026-09-14T19:18:52Z","basis":"configured","source":"provider configuration","check":"the providers the workspaces hold keys for, read when the page is asked for","providers":[]},"certifications":{"verifiedAt":"2026-09-08","basis":"reviewed","source":"infra/chart/trust/certifications.yaml","check":"the reviewed file, with what is not claimed stated as plainly as what is","held":[{"scheme":"ISO/IEC 27001","holder":"OVHcloud, the hosting supplier","scope":"The supplier's own datacentres and platform operations, not this service running on them","region":"eu-west-par","evidence":"The supplier's published certificate, checked at the deployment's review"},{"scheme":"BSI C5","holder":"OVHcloud, the hosting supplier","scope":"The supplier's German platform operations, not this service and not the region this deployment runs in","region":"de1","evidence":"The supplier's published attestation report, checked at the deployment's review"}],"notClaimed":["SecNumCloud: not held for this deployment. The qualification applies to specific supplier offerings and regions, and this deployment does not run on one of them.","ISO/IEC 27001, SOC 2 and any other scheme for RegInspect Ltd itself: none is held. What is listed above is the hosting supplier's, for the supplier's platform.","BSI C5 for the region this deployment runs in: the attestation above covers the supplier's German region, which this deployment does not use.","Any certification of the model providers a workspace configures: those are the providers' own and are stated in the inference section as each provider reports them."]},"legal":{"verifiedAt":"2026-09-14T19:18:52Z","basis":"configured","source":"infra/chart/trust/legal.yaml","check":"the reviewed file","documents":[]},"posture":{"verifiedAt":"","basis":"","source":"","check":"","test":null,"findings":{"open":0,"closed":0,"exceptions":0}}},"configured":[],"configuredInference":[]}