Security at RegDataLab
RegDataLab is operated by Wasatch Crest Holdings LLC. This page states how the service handles transport, credentials, and account data.
October 2026
Transport
The site and the API are served over HTTPS at www.regdatalab.com. The API connects to its Postgres database over TLS.
| Header | Value |
|---|---|
| Strict-Transport-Security | Website pages: max-age=63072000. API responses on HTTPS: max-age=31536000; includeSubDomains. |
| Content-Security-Policy | Includes default-src 'self', frame-ancestors 'none', and object-src 'none'. |
| X-Frame-Options | DENY |
| X-Content-Type-Options | nosniff |
| Referrer-Policy | strict-origin-when-cross-origin on the site and the API. |
| Permissions-Policy | camera=(), microphone=(), geolocation=() |
/recover and /verified send only the origin as the referrer. Report-download links send no referrer.
API keys
Each API key is 256 bits of random data, with an fda_ prefix. The database stores the SHA-256 hash of the key and its first 8 characters. The full key is shown once, when it is issued, and is not stored.
The server accepts API keys only in headers:
Authorization: Bearer <key>Authorization: <key>x-api-keyx-auth-token
A key in the URL is not a credential. A request to /mcp or /account that puts a key in the query string is refused and is not authenticated. The account page sends the key with the request and does not write it to browser storage. Client setup is in the connect guide.
OAuth
OAuth is on. Claude and ChatGPT sign in on the RegDataLab consent page and then call https://www.regdatalab.com/mcp with an access token in the Authorization header. The published scope is fda:read. Discovery is at /.well-known/oauth-authorization-server.
You approve by pasting the API key once, or, for an account with a verified email or a key emailed at checkout, by opening an email sign-in link in the same browser. The connector then uses its own access and refresh tokens. Grok and other MCP clients send the account API key in a header.
Access tokens, refresh tokens, and authorization codes are stored as SHA-256 hashes. Access tokens expire after one hour and refresh tokens after 30 days, unless those durations are changed in server configuration.
Subprocessors
These providers process account or website data. The privacy policy is the full description of what each one receives.
- HerokuAPI, MCP server, and Postgres database (United States)
- VercelWebsite hosting and Vercel Web Analytics
- GoogleGoogle Analytics 4 website analytics
- SentryError monitoring and diagnostics
- StripePayment processing. Card numbers are not stored
- CloudflareBot protection (Turnstile) and CDN
Account and data deletion
The account owner deletes the account on the account page. Sign in with the owner key, choose Delete account, and type DELETE to confirm. Deletion is irreversible.
The server cancels every stored Stripe subscription, including supplier monitoring, before it removes the account row and the API keys. A cancel that does not complete leaves the account in place. A charge already paid is not refunded. The Stripe customer record stays in Stripe. Card numbers are not stored.
Removing those rows removes the tool-call log, OAuth tokens, authorization codes, and email sign-in rows that reference the keys. The privacy policy lists the rows that stay: billing events keep their payload and drop the key id, and a failed sign-in row drops the key id.
Manage billing on the account page opens Stripe. Cancelling a paid plan returns the account to the free plan. It does not delete the account or the tool-call log. Lost-key recovery rotates the API key. The old key stops working. It revokes OAuth grants. Recovery disconnects the account's OAuth connections (such as Claude or ChatGPT), so you'll need to reconnect them with the new key. Email sign-in leaves your API key in place and does not revoke OAuth grants. It leaves the account row and the tool-call log in place.
An inactive owner key cannot delete the account. Email hello@regdatalab.com for help.
Contact
Wasatch Crest Holdings LLC
8 The Green STE B
Dover, DE 19901
USA
Email hello@regdatalab.com for help and for security reports. Delete the account from the account page. The published contact file is /.well-known/security.txt.