---
title: "Information Security & Technical Architecture — ReguLex.uk"
source_url: "https://regulex.uk/legal/security"
canonical_url: "https://regulex.uk/legal/security"
retrieved_by: "AnswerRail Edge Engine v1.1.0-parity-v20 (https://answerrail.com)"
provenance: "Compiled for deterministic AI retrieval by AnswerRail Edge (RFC 9110 / RFC 9421)"
description: "Defence-in-Depth Architecture, ISO 27001 Alignment, and Sovereign Infrastructure. Formal statutory disclosures for UK chartered accountancy practices."
rfc_compliance: "RFC 9110 / RFC 9309 / RFC 9421"
version: "1.1.0"
release_version: "v1.1.0-parity-v20"
signing_kid: "ar_ed25519_2026_k1"
jwks_uri: "https://answerrail.com/.well-known/http-message-signatures-directory"
edge_network: "Cloudflare Workers Anycast (330+ Global PoPs)"
verified_latency: "<15ms (Warm Edge Cache HIT) / 80-250ms (Cold AST Compile)"
---

> **Canonical Source:** [https://regulex.uk/legal/security](https://regulex.uk/legal/security)
>
> *Defence-in-Depth Architecture, ISO 27001 Alignment, and Sovereign Infrastructure. Formal statutory disclosures for UK chartered accountancy practices.*

# Information Security & Technical Architecture

Defence-in-Depth Architecture, ISO 27001 Alignment, and Sovereign Infrastructure

## 1. Security Architecture Overview

ReguLex operates a defence-in-depth security perimeter engineered specifically to meet the risk governance standards of top-tier UK chartered accounting practices. Every packet, database transaction, and document generation pipeline is isolated within dedicated infrastructure with zero shared memory exposure.

## 2. Encryption in Transit & at Rest

- **In Transit:** All HTTP traffic is secured via TLS 1.3 with Perfect Forward Secrecy (PFS), enforced by HTTP Strict Transport Security (HSTS) with preloading. All inbound connections terminate on Cloudflare’s London (LHR) sovereign edge.
- **At Rest:** Internal practice cluster databases and cache tables are encrypted using AES-256 GCM. Sensitive practice API keys and officer biometric IDV audit records are hashed using bcrypt with salt rounds adhering to NCSC guidelines.

## 3. Dedicated Droplet Isolation

Unlike multitenant multi-app shared hosts, ReguLex runs on a dedicated London cloud instance (`134.122.100.11`) hosted in DigitalOcean’s `lon1` London data centre. This dedicated environment guarantees:

- Zero memory leaking or cross-tenant cache contamination.
- Deterministic sub-50ms statutory processing latencies.
- Strict kernel-level firewall enforcement (UFW) permitting only encrypted ports 22, 80, and 443.

## 4. Vulnerability Management & Incident Response

Automated dependency audits, static application security testing (SAST), and runtime anomaly monitoring run continuously across our CI/CD pipelines. Security incident disclosures should be submitted immediately to `[[email protected]](https://regulex.uk/cdn-cgi/l/email-protection)` for priority triaging within four (4) business hours.

---

## 🏛️ AI Ingestion & Edge Optimization Provenance
This sovereign authority subpage is compiled and delivered across 330+ Cloudflare Anycast edge locations by [AnswerRail](https://answerrail.com) for [https://regulex.uk/legal/security](https://regulex.uk/legal/security).