What happens to the data you upload for a test run.

What a test run does

A test run takes the file you upload, maps it against the framework you selected, applies the validation rules in force, and returns a validation report. On the free tier the output package is not produced; on a paid plan it is. Nothing else happens to the file. It is not used to train anything, it is not analysed for commercial purposes, and it is not shared.

Where the data sits

Customer regulatory filing data is processed and stored within the European Union. Supporting services that do not handle filing data — analytics, consent management, email, payments — are separate, are disclosed in the privacy notice and subprocessor list, and do not receive uploaded filing data.

Who can access it

Access is limited to the account that uploaded the file, and to the smallest set of staff who need it for support and platform operation, under access controls and audit logging. Where support is requested, access is on request rather than standing, and it is logged.

Where several people share an organisation account, they share visibility of what is uploaded to it. Groups filing for multiple entities that require separation between teams should raise that before uploading, because it is an account structure question rather than a permission toggle.

How long it is kept

Test data is retained for a limited period so you can re-open the validation report and compare runs, and is then deleted. You can delete an upload before that point. Deletion removes the source file and the derived working data; where a validation report has been downloaded, that copy is yours and is outside the platform.

The retention period for test data is set out in the retention schedule referenced from the privacy notice, and differs from retention on a paid plan, where the filing record has a longer useful life.

What leaves the platform

• Nothing is submitted to any authority. The platform produces a file. Transmission to a supervisor or tax authority is yours to make.
• No output is sent anywhere automatically. Reports and packages are downloaded by you.
• Notification emails carry no filing data — they tell you a run finished, not what was in it.

Reducing what you upload

The most effective control is not uploading more than the test needs. Three approaches work without weakening the test:

1. Test with a subset. A representative slice exercises the mapping and the validation rules as well as a full population does.
2. Pseudonymise identity fields where the test is about structure rather than about identity. Format-preserving substitutes still exercise format validation.
3. Test structure before substance. A first run on shape and coded values catches most findings before any live identity data is involved.

These reduce exposure during evaluation. They are not a substitute for the contractual position when you move to production, which is what the data processing terms exist to settle.

REGREP is an independent software provider. This record explains a reporting framework in plain language and is not legal, tax or regulatory advice. Confirm scope, thresholds and submission dates with your competent authority before you file.