Unlock, sign & maintain

Free gives you the whole map and a DRAFT record — forever. Paid unlocks the defensible one: the DRAFT stamp comes off, the record is signed under a named person, and it is kept current. This page walks you through the whole thing in order — answer two questions, pay, name the controller, review, sign — then what OFFICIAL is, and how the seal stays honest over time.

Land here from: Fill the RoPA (and, for a regulated firm, The DORA register). Everything is filled and confirmed; now you make it official.

Step 1 · Answer the two unlock questions — your plan and price

Pricing is published, self-serve, and all-in — one yearly charge, no setup fee. The plan is worked out from two answers at unlock, never guessed from your scanned data. Answer them like this:

The €6,000 and €12,000 tiers close with a card, no salesperson. More than 250 staff routes to the Enterprise conversation — still a published floor price, invoiced, never "ask us". You manage the subscription later from Account → Billing.

The four steps that make a record official sit in an annex at the foot of the claimed record, headed Make this record official.

Here it is on a record whose licence is already paid, so step 2 reads nothing to choose or pay. On an unlicensed record, step 2 is where you answer the two questions above and the published price appears:

Step 2 · Pay — paying is not signing

In the portal: answer the two questions and the price appears; press Continue to payment (card, via Stripe). A leave page notes that you enter your card on Stripe (Regixo never sees or stores it) and come straight back. On return you see ✓ Payment received — activating your licence…, then a receipt. Keep that receipt — it shows your licence key (step 6’s seam to the engineer).

Step 3 · Name the controller

An Article 30 record is the controller's record. Regixo refuses to seal one whose controller is unnamed — an OFFICIAL document with no responsible organisation is indefensible. The refusal is the coded error CONTROLLER_REQUIRED, raised before any signing happens.

Supply the registered legal name once, either way:

regixo.yml — the engineer

controller: { name: "Acme Europe BV", contact: "dpo@acme.eu" } — headless, committed with the config.

the claim page — the compliance team

Fill the organisation field on the record; it is persisted before the seal step opens.

Step 4 · Review “Before you sign”

Signing is a legal act, so there is a deliberate gate before it. When you press to sign, Regixo shows a Before you sign summary — who you are signing as, the controller, the plan, and what is still open. Decide you’re ready by checking:

• Every legal call is confirmed — no activity still shows needs you. (Filling them is the previous station, Fill the RoPA.)
• The controller is named (step 3) and the signer is the right person in the right role.
• For a regulated firm, the DORA scope rulings are made — no candidates left unruled (The DORA register).

Step 5 · Sign & seal — the flip to OFFICIAL

In the portal an approver or admin presses 🔓 Sign & seal this record as <name>, reads the Before you sign page, and confirms — the record flips to the OFFICIAL seal block. On the command line the same licence activation is regixo verify.

What signing actually is. Signing produces a simple electronic signature over the exact bytes of the record. Regixo serialises the OFFICIAL record, takes its SHA-256, and signs that hash with a dedicated Ed25519 attestation key — separate from any licence key. The signing timestamp is set by the server and is immutable; it is never taken from the client.

The seal also states how the signer was identified — one of three assurance levels, and the artifact never overstates it. Which one you get depends on how you signed in:

sso — the strongest

A real authenticated session through the organisation's single sign-on. You get this when your org has SSO configured and you signed in through it.

email-verified — the default

A magic-link sign-in proved control of the email address. This is what a normal portal sign-in gives you.

env-declared — a dry run only

An identity declared at unlock via env var — marked non-production on the artifact, since no one verified it. Fine for a dry run, not for a filing.

The signed bytes also bind the signer's organisation and role, so the seal proves "an authorised officer of <organisation>", not just a verified inbox. The signer therefore appears in full capacity — name, role, organisation — wherever the signature is shown.

$ export REGIXO_LICENCE_KEY='rgx_live_…'
$ regixo verify

If any legal call is still open, regixo verify refuses with OPEN_LEGAL_CALLS and lists every one. Sealing anyway is a deliberate act, so it takes an explicit flag — regixo verify --seal-with-open-calls — and the acknowledgment is recorded on the seal. Regixo never confirms a legal call for you.

The forker's copy has no regixo verify to unlock — sealing lives in the private layer and was never in the public code. Gating is the absence of code, not a switch.

Step 6 · What OFFICIAL adds over DRAFT

The record body is the same shared renderer in both states — OFFICIAL is a superset of the DRAFT, never a thinner copy. What changes is the evidence around it:

• The DRAFT watermark comes off, replaced by a running ● OFFICIAL — ATTESTED mark on every page.
• A seal card lays out the signature facts (below).
• A standalone offline verifier (verify-attestation.mjs) ships next to the artifact, plus ATTESTATION_KEYS.md, which ships in the Regixo repository — so anyone can check the seal with no Regixo server in the loop. (The repository is not public yet — that is a launch step.)
• Every signature seals an immutable snapshot; the change log and version history keep the diffs.

The seal card carries these rows, each stating exactly what it is:

The Content seal line under Technical details is the SHA-256 of the file a verifier can recompute — flip a single byte and the check fails. The Timestamp row is honest about what backs the time today — it becomes a When row carrying the counter-stamp facts once a timestamp authority is configured; see What is not built yet.

The engineer runs the licence + pull in one sequence — a person’s act on the machine that holds the record, so the OFFICIAL artifact lives next to the source it describes:

$ export REGIXO_LICENCE_KEY='rgx_live_…'
$ regixo verify
$ regixo seal pull <claimToken>

Fetching a seal is mechanical — but it is bundled here with the signing sequence a person runs. For a regulated firm the DORA package is built the same way, with regixo dora export on the engineer’s host (see The DORA register).

Step 7 · Maintain it — drift, re-sign, renew

The record keeps changing as your data does. A signature does not silently follow it. When regixo watch re-scans and a core field of a signed activity moves, that activity — and only that one — is flagged as needing re-signing:

What an auditor sees while a signature is re-opened. Between the moment a core field moves and the moment you re-sign, the record does not pretend to be clean. It stays OFFICIAL for the activities that did not change — their sealed snapshots are untouched and still verify — while the changed activity carries a visible needs re-sign flag and the seal card’s band drops its “audit-ready” line until the re-signature lands. An auditor reading it in that window sees exactly the truth: a signed record with one activity openly marked as pending review. Nothing is silently re-sealed, and nothing is silently un-signed. Whoever signed is the person prompted to review the diff and re-sign.

Renew each year

The licence is yearly — annual renewal is the model, because the record is a living document, not a one-time file. An expiry warning shows from 30 days out; the record stays fully OFFICIAL while it warns. Renew from Account → Billing (Renew →, Upgrade to RoPA + DORA →, or Billing in Stripe → for invoices and card details). For a regulated entity the DORA register carries a hard annual deadline, so the yearly cadence is not optional there.

The evidence pack

The defensible deliverable a compliance team can put in front of an auditor is the record plus its proof. Its parts:

• Official record (PDF) — the sealed Article 30 document, no DRAFT stamp.
• Source attestations — each mechanical field traced to the system it came from, as of a date.
• Append-only change log — every change since the first draft.
• Immutable snapshots — one per signature.
• Machine-readable bundle — the record as data; for DORA, the xBRL-CSV package.
• Attestation public key + the offline verifier — plus printed verification instructions in the PDF.

Anyone holding the exported folder can check the seal without Regixo — run the verifier next to attestation.json:

$ node verify-attestation.mjs

Cross-check the key against ATTESTATION_KEYS.md in the Regixo repository (not public yet — that is a launch step). The evidence is designed to outlive the vendor.

The free layer ships its own bundle today: regixo evidence assembles the DRAFT record — the RoPA, the DORA register when in scope, the change-log and the sources — into one JSON with a sha256 fingerprint per artifact, and regixo evidence verify re-checks every fingerprint. It attests nothing: the fingerprints live inside the file, so it catches corruption and careless edits, not someone determined. The signed, sealed OFFICIAL pack above — attestations, immutable snapshots, the offline verifier — is what the paid layer adds.

What is not built yet

How you know you’re done

The record reads ● OFFICIAL — ATTESTED, not DRAFT; the seal card names who signed, when, and how they were identified; and the offline verifier passes next to attestation.json. From here it is a living document: keep it current from the engineer’s side, and re-sign the one activity a scan flags when a core field moves.