The compliance team
An engineer forwarded a draft record built from their real systems. This is the whole compliance-team side, in one sitting: open the link, sign in, add a colleague, make the legal calls, then make the record official under a named person. Reading needs no account — only filling and signing need a session.
Optional · EU compliance module
You need this only if your company must keep a GDPR Article 30 RoPA or a DORA register — it is an optional module on top of the free data catalog. If that is not you, you can skip this section.
What you need
The claim link and the
RoPA_DRAFT.pdf your engineer sent — nothing to install. Screens
below are static examples of what you'll see, not live widgets.1
The email arrives compliance
Your engineer's message carries two things: a
RoPA_DRAFT.pdf and a claim
link — app.regixo.com/claim/<token>. Open the link.The PDF opens with no tools and carries a DRAFT stamp;
the link opens the same record, live, in your browser. Both point at one record — the PDF is for
reading offline, the link is for filling and, later, signing.
Next: land on the record.
2
Land on the record — not signed in
The link drops you straight onto the record. No login to look. Read the header first:
it tells you what this is, where it came from, and what is left.
GDPR · Art. 30 · Record of Processing — drafted from your own systems
Record of Processing Activities
3 records · 3 named · 3 with open calls
Your engineering team answered their part on 2026-07-10. 3 fields came from them — security measures, recipients, data subjects. They are facts about the systems, not legal decisions: yours to review and confirm below.
Read this first
- What this is — the list of how your company uses people’s personal data — the “Record of Processing” most EU organisations must keep.
- Where it came from — your engineering team mapped the sources they configure with Regixo, which drafted this from their schemas.
- What’s done — the data inventory is mapped for you.
- What needs you — 10 legal calls are still blank — purpose, your lawful basis, retention and transfers. Your team fills them below; then you sign.
- Your privacy — what reached this page is metadata only: the drafted record, the names of the 4 tables behind it, and counts. No column names, no column types, no row values — they never left your team’s machine.
- What’s not covered —
snowflake-dwh,stripe(unreachable at the last scan).
Forwarded draft — received 2026-07-10 · what left their machine: metadata only — the names of the 4 tables these activities are built from, the drafted record, and counts (4 datasets · 9 personal-data flags). No column names or row values, ever. No account needed to review. · what changed → · who is Regixo? →
A finished-looking document built from your engineer's real tables — not a blank
form — with a provenance line that states plainly what was uploaded: metadata only, no row values.
You set the bar for what you'll sign
Partial coverage is shown, never hidden: the header names any source that was unreachable at the
last scan (
snowflake-dwh, stripe here), and later, at signing, every open
legal call seals as a flagged gap, listed before you sign. What counts as “complete enough to
sign” is your call, not Regixo's — you can seal now with the gaps on the record, or send the
unreachable sources back to your engineer first. The tool keeps the state honest; the standard is
yours.Full detail: Claim & review →
3
Sign in to fill
Reading the record never needs an account. To change or confirm anything, press
Email me a sign-in link and enter your work email. Regixo sends a one-time link — no password to
set. Opening that link does not sign you in on its own: it lands on the small page below, which names
the address you are signing in as and waits for you to press Continue to sign in →. That extra
press is deliberate — corporate mail scanners follow links, and a scanner must not be able to consume
your sign-in by opening the mail.
Confirm it’s you
You’re signing in as d•••@acme.eu. One click and you’re back on your record.
Didn’t request this sign-in? Close this tab — the link works once and expires 15 minutes after it was requested; nothing has happened yet.
Corporate mail scanners open links, so a click lands first on a Confirm it's
you page — pressing Continue to sign in → is what actually signs you in. The first person
to sign in on a claim becomes its admin.
Next: bring in a colleague.
4
Add a colleague
Open the Your team annex from In this dossier in the rail, press
Send invite (they join as a viewer by default), enter their email, and set their role
to preparer so they can fill the draft.
Roles are per record, never global: a viewer reads · a preparer fills ·
an approver confirms and signs · an admin does all of that and manages the team. A
preparer's work saves as provided, never as a confirmation.
Full detail: The compliance portal — team & roles →
5
A preparer fills a legal call compliance
Every activity is a numbered section of the document, its fields already open, and
the Schedule — open items on this record at the foot lists what is left. Security measures,
recipients and data subjects are facts about the systems — they usually arrive pre-answered by the
engineering side (Your part); review them, and fill in anything the engineer left blank. The
seven legal calls are yours: on the lawful-basis row click + Fill this. Pick a ground, or type
your own.
GDPR · Art. 30 · Record of Processing — drafted from your own systems
Record of Processing Activities
1 / 3
Marketing & email outreach
2 open callsusers
⚠ Needs you: confirm the legal fields (purpose, lawful basis, retention).
| Personal data | contact, account, consent found |
|---|---|
| Recipients | Stripe found ✎ edit |
| Lawful basis | The person agreed to it. Art. 6(1)(a) consent suggested + Fill this |
A person confirms legal fields — not Regixo.
Purpose, lawful basis and retention are legal judgements: Regixo drafts them from the data and never confirms one; the compliance team reviews and signs. Security measures, recipients and data subjects are not legal calls — they are facts about the systems, and the engineering side answers them.
The value is filled, badged provided, and the
activity leaves the Still needs you list — whose heading moves on to Awaiting
confirmation. Special-category rows also ask for an Art. 9(2) ground.
Full detail: Fill the RoPA →
6
The gaps shrink
Work down the Still needs you index — every activity with an open field is listed,
so nothing is missed.
As the calls get filled and confirmed, the index heading moves through three honest
states: Still needs you → Awaiting confirmation → Nothing still needs you. You
always know exactly where the record stands.
Next: an approver confirms.
7
An approver confirms compliance
An approver opens each filled row and ticks the confirm checkbox:
Confirm as legally reviewed — you act as approver; Regixo never confirms a legal field for
you.
A confirmed field records who confirmed it and when. If your
organisation isn't named yet, you're asked for the controller's registered legal name — a
record of processing must identify the controller (GDPR Art. 30(1)(a)), and Regixo never guesses it.
Machines suggest, humans confirm
Regixo never sets a legal field to “confirmed” on its own. Purpose, lawful basis, retention and
transfers are legal judgments — the tool suggests and sanity-checks; a named human confirms. A
confirmation must carry the name of the person who made it (
REGIXO_SIGNER_EMAIL;
without it you get SIGNER_REQUIRED), and a confirmed answer that names nobody is
refused outright — ROPA_CONFIRM_UNATTRIBUTED — even on import. No agent may confirm
on your behalf: the read-only MCP server has no tool that could, and no agent sentence is offered
for the command that does.8
Make it official
Open Make this record official. It runs in four steps — Review & fill,
Choose your plan, Verify it's you, Sign & seal. Step 1 shows how many calls
are confirmed; Step 2 asks two questions to set your price.
Review & fill the legal calls
1 of 16 confirmed — 10 blank · 5 awaiting confirmation. Review & fill →
You can seal with open calls — they seal as flagged gaps, clearly listed before you sign.
Choose your plan
Your plan is set by the licence on this record — nothing to choose or pay. Verify and sign below to apply it.
Verify it’s you
Signing is a legal act under your name, so we confirm your identity once — with a one-time email link. Reading this record never needs an account.
Sign & seal
Verify your email in step 3 first — the seal records who signed.
Nothing new leaves your systems when you sign — signing only seals what you already see on this page.
The published price appears from your two answers — never guessed from your scanned
data. Yes to the financial-firm question adds the DORA register (€12,000/yr); More than
250 routes to Enterprise — from €18,000/yr, invoiced, price published.
Nothing about the money is sprung on you
Reading the record needs no account and costs nothing; the price only ever appears at signing,
and it comes from your two plain answers — the financial-firm question and the head-count band —
never guessed from your scanned data. The published €6,000 / €12,000 / from €18,000 tiers
are the same on the page as on the invoice: no “ask us”, and no quote that shifts once they know your
size.
Next: pay.
9
Pay
Press Continue to payment (card, via Stripe). A leave page explains you'll enter
your card details on Stripe's payment page — Regixo never sees or stores them — and come
straight back.
PlanRoPA · Article 30 official record
Billed yearly€6,000 / year
✓ Payment received. Your licence is active until 12 July 2027.
The DRAFT stamp comes off when you sign. A receipt is on its way to dana@acme.eu.
Receipt
PlanRoPA · Article 30 official record
Billed€6,000 / year
Licence valid until12 July 2027
Charged€6,000.00 · VAT €0.00 (reverse charge)
RecordAcme Europe BV · a1f3c9e2b7d4…
↓ Download invoice (PDF)Invoice & VAT receipt issued by Stripe.
On return you see ✓ Payment received — activating your licence…, then a
receipt with a downloadable invoice. The €6,000 and €12,000 tiers close with a card,
no salesperson.
What works today
Stripe checkout is wired and offline-tested; the live card-payment run is a launch gate. Until
it runs, a licence is provided by Regixo on invoice — the sign & seal path below is the same
either way.
10
Verify & sign
Step 3 is Verify it's you; Step 4 is Sign & seal. Press
🔓 Sign & seal this record as <name> and read the Before you sign page.
Before you sign
You are about to sign and seal this record for the first time, as Dana Kessler (dana@acme.eu). This removes the DRAFT stamp and records a simple electronic signature (eIDAS Art. 25(1)) under your name.
What kind of signature is this?
- It is a simple electronic signature. Under EU law (eIDAS Art. 25(1)) it cannot be denied legal effect, or refused as evidence, solely because it is electronic. It is not a qualified electronic signature — that needs a government-issued certificate Regixo does not require.
- The time comes from our server's clock. That records when you signed. On its own it is not an independent timestamp.
- An independent counter-stamp adds more. Where one is configured, a third-party timestamp authority stamps the signature, proving it existed no later than that moment — still not an eIDAS qualified timestamp, but no longer resting on our clock alone. Your sealed record names which one it carries.
Regixo could suggest a value for every legal entry — review them before you seal; they record as suggestions for your confirmation, and the seal never confirms a legal entry for you (a person must).
Nothing new leaves your systems when you sign — signing only seals what you already see.
The page states exactly what signing does: it removes the DRAFT stamp and records
a simple electronic signature (eIDAS Art. 25(1)) under your name. It is not a qualified electronic
signature. Confirm, and the record flips to OFFICIAL. Only an approver or admin can sign.
Next: the sealed record.
11
It's OFFICIAL
The record is signed. The DRAFT stamp is gone, and a seal block lays out the signature
facts.
✓ Sealed 12 Jul 2026 · every legal field confirmed
● OFFICIAL — signed & sealed
- Who signed — Dana Kessler, Data Protection Officer of Acme Europe BV — dana@acme.eu, on 12 Jul 2026, 09:41:26 UTC. Identity verified by an email sign-in link.
- Timestamp — The signing time comes from Regixo’s own server clock. No independent counter-stamp is attached. attestation.json records the authoritative timestamp status.
- What kind of signature — A simple electronic signature. Under eIDAS (Art. 25(1)) it cannot be denied legal effect solely because it is electronic. It is not a qualified electronic signature.
- Tamper-evident seal — Locked: any later edit re-opens the signature. Anyone can check it’s genuine offline, without contacting us — see “Technical details”.
- Your record — Plan ropa · valid until 12 Jul 2027. Manage billing →
Technical details (for your auditor)
Content seal sha256:b47a91…3e06d8 — any later edit re-opens the signature.
Attestation att_4e19c2a75b8f3d60e1a9c4b2 · key regixo-attest-prod-20260714 · tenant acme.
Verifiable offline: run node verify-attestation.mjs next to the exported attestation.json (key published in ATTESTATION_KEYS.md).
This attestation states a mechanical fact: the auto-filled fields were taken from Regixo’s index of metadata read from the connected systems, as that index stood when this record was generated on 12 Jul 2026. The legal fields (purpose, lawful basis, retention, transfers) are the signatory's to decide. The seal covers the record as it stands; it never confirms a legal call. This document is not legal advice.
The seal names who signed in full capacity — name, role, organisation — carries
a content seal over the exact record bytes, and ships with an offline verifier so anyone can check it
without Regixo. That is the defensible record.
Full detail: Unlock, sign & maintain →
Honest about what's live
Reading is free and account-free; only filling and signing need a session. The fully hosted portal at
app.regixo.com and live card payment are launch gates, not yet switched on — but the
forwardable DRAFT PDF and claim link work today, and the fill, confirm, sign and seal path is
built. Until live card payment is switched on, Regixo issues the licence on invoice — the sign &
seal path is the same either way.
Your next step
You made the calls and sealed the record. See the same loop from both sides — how this draft reached you,
and how the sealed evidence travels back to the engineer who forwarded it:
The hand-off round-trip →.