Where we stand today, stated plainly.
Institutions that are examined cannot take a vendor’s word for anything. This page names plainly what we do not yet hold and lists the sub-processors of this website. The RegNovaIQ platform is not yet in production. Its sub-processors and controls will be published here before launch.
Our customers will entrust us with the records they are examined on — customer identities, payment activity, and the evidence behind every compliance decision. We treat that material as the product, not as a byproduct of it.
Status at a glance
- We hold no SOC 2 report. No SOC 2 examination has been completed.
- No ISO/IEC 27001 certificate, and no certification in progress.
- No independent penetration test has been completed.
- Pre-revenue. No customers, and no live client data on the platform.
- The platform is not yet in production.
Where we stand today
We are early. This is what that means.
- RegNovaIQ is pre-revenue. We have no customers.
- No client data is being processed. There is no live customer tenant, and the platform has never carried live client traffic.
- We hold no SOC 2 report. No SOC 2 examination has been completed. We hold no ISO 27001 certificate.
- No independent penetration test has been completed. No third party has yet tested this platform.
- We are a small team.
The RegNovaIQ platform is not yet in production. Its sub-processors and controls will be published here before launch.
How to use this page
What this page covers, and what it does not.
Everything on this page is open — no form, no email, no NDA. For a security question, write to security@regnovaiq.com.
This page describes our security posture only. It does not describe how the platform reaches a decision. That omission is deliberate and permanent.
You can verify one thing about us without contacting anyone: run any public TLS scanner against regnovaiq.com. The site is served over HTTPS with HSTS, a restrictive content security policy, X-Frame-Options: DENY, and X-Content-Type-Options: nosniff.
On this page
Certification and assurance status
Stated as it is, not as we would like it read.
| Framework | Status | Detail |
|---|---|---|
| SOC 2 Type I and Type II | Not held. | We hold no SOC 2 report. No SOC 2 examination has been completed. |
| ISO/IEC 27001:2022 | Not held. Not in progress. | No certificate exists. |
| Independent penetration test | Not completed. | No report exists. |
We will publish a certificate on this page on the day it is issued, and not before.
Personnel and company
A small company should say what it is rather than describe a security organisation it does not have.
- Financial position
- Pre-revenue.
- Team based in
- London, United Kingdom
Sub-processors
The RegNovaIQ platform is not yet in production. Its sub-processors and controls will be published here before launch. The table below covers this website and our company email.
Website and corporate systems
| Sub-processor | Purpose | Processing region |
|---|---|---|
| Microsoft Azure (Static Web Apps) | Website hosting and delivery for regnovaiq.com | Resource region: West Europe |
| Cloudflare | Domain name system (DNS) for regnovaiq.com, and edge proxy where enabled | Global edge network |
| Zoho Mail | Company email, including enquiries sent to contact@regnovaiq.com | European Union (Zoho EU data centre) |
Not used on this website
- No contact form: enquiries are sent by email from the visitor’s own mail client.
- No analytics or tracking script and no third-party fonts; every asset is served from regnovaiq.com.
Security contact and vulnerability disclosure
Report a suspected vulnerability to security@regnovaiq.com.
Include the affected component, reproduction steps with a minimal proof of concept, the impact you assessed, and whether the issue has been disclosed elsewhere.
Scope
In scope: this website, at regnovaiq.com and www.regnovaiq.com.
Out of scope: denial-of-service requiring sustained high-volume traffic, findings that depend on social engineering our staff or partners, issues in third-party services we do not operate, and theoretical findings without a working proof of concept.
We do not currently run a paid bug bounty.
What we do not claim
A short list, because the absence of these sentences elsewhere on this page is easy to miss.
- We do not claim any third-party security certification.
- We do not claim a customer base, a reference, or a production deployment.
- We do not claim a recovery time objective we have not measured.
- We do not claim independent testing we have not commissioned.
- We do not describe how the platform reaches a decision, here or anywhere else public. That is deliberate.
A compliance vendor that overstates its own controls has already told you how it will handle an examination. We would rather be assessed on what is here.
Corporate information
RegNovaIQ is the product. NOVAIQ LIMITED is the company of record.
- Registered name
- NOVAIQ LIMITED
- Company number
- 16948483
- Place of registration
- England and Wales · Private limited company
- Incorporated
- 7 January 2026
- Registered office
- Flat 137 Leon House, 233 High Street, Croydon, England, CR0 1FX
- Nature of business
- Business and domestic software development (SIC 62012)
- UK data protection registration
- Not stated on this page.
Founders
- William Davis — Co-Founder
Member of NVIDIA Inception since 3 September 2026. Inception is a startup programme; it is not a security assessment, certification or endorsement, and we do not present it as one.
Page maintenance
Who keeps this page true, and how often it is checked.
- Review cadence
- Quarterly, and after any material change to a control, a sub-processor, or our certification status.
- Contact
- security@regnovaiq.com