Free, local-first data catalog that auto-drafts your EU compliance evidence — a GDPR Article 30 RoPA (Record of Processing Activities) and a DORA register. One command, about 5 minutes, no Docker. Raw data never leaves your machine — the scanner reads names and types, never the values.

regixo.com · docs.regixo.com · Security policy · Contributing

Real output — regixo from npm scanning a seeded demo Postgres. The transcript is verbatim; the data is synthetic — no real records anywhere in the pipeline.

An engineer runs one command and gets a searchable map of where personal data lives, plus a DRAFT of the GDPR Article 30 record. They forward it to the compliance team, who finish it, sign it, and unlock the OFFICIAL, defensible version in the paid portal.

Other tools draft this record from a scan too. What is different here: free tier, published price, no sales call.

GDPR Article 30 requires this record, and Art. 30(5) exempts firms under 250 persons unless any one of these is true: the processing is likely to result in a risk to people's rights and freedoms, it is not occasional, or it involves special-category or criminal-offence data.

npx regixo start     # scan (metadata only) + draft the RoPA → your data map
npx regixo open      # the free portal: map · record (+ DORA register, if in scope) — localhost:4319
npx regixo invite    # a forwardable DRAFT PDF + claim link — uploads a metadata snapshot; --no-upload keeps it local

It finds a database on its own from the usual environment variables:

Postgres, MySQL and SQL Server are verified end-to-end against real databases. Snowflake, BigQuery and Stripe are tested against fixtures and have never run against a live account, and Redshift reuses the Postgres driver but has never been pointed at real Redshift — if you use one of those, failures are loud and a report helps. CI does not yet run the remote connectors, so treat them as unguarded against regressions rather than untried.

Add anything else with regixo add: Stripe, a dbt manifest, or a CSV you write by hand. The full guide lives at docs.regixo.com.

Pre-1.0 and in active development — npx regixo start runs the current pre-release build (Node ≥ 22.18 the only prerequisite, no Docker). Prefer source? Clone and run from a checkout (see Develop).

Working in Claude Code, Cursor, or Codex? Regixo is built to be driven by an agent, not only a human at a prompt.

npx regixo skill --write   # the operating playbook, into AGENTS.md — the file most coding agents read first

• Every command runs headless: --json everywhere, coded errors instead of prompts, idempotent setup — an agent never waits at a blocking prompt.
• The agent reads the catalog through a local, read-only MCP server (regixo mcp) and a versioned /api/v1 — zero egress. Each personal-data flag carries how it was recognised (known sensitive name · by field name · by name pattern · by column type, plus the term-pack language) and a confidence score, and a provenance trust signal says when not to trust an answer: stale scan, unreachable source, machine guess vs human-confirmed. The screen shows the reason in plain English; the score is in the API, not on the page.
• The read surface cannot cross the line by construction: the MCP server and /api/v1 expose no write tool at all, so nothing an agent reads can confirm a legal field. Confirming one is a deliberate, identity-attributed act on the CLI (regixo annotate … --confirm, which requires a signer identity) or in the portal — the machine never does it on its own initiative.
• Need a source Regixo doesn't ship? The agent can author a connector for it — regixo connectors.

• A data map — every dataset and column, with the personal-data columns flagged and the reason each was recognised shown in plain English, searchable, and refreshed on a re-scan.
• A RoPA DRAFT — your tables grouped into activities by the job they serve, mechanical fields auto-filled and traced to their source; the legal fields marked needs you, never guessed.
• A DORA register DRAFT — for financial entities. Be clear on the fit: the map auto-starts 2 of the 15 Register-of-Information tables (the ICT third-party providers it can trace to your sources); the other 13 are needs you, because contracts and arrangements are not in a schema.
• An Article 30(2) processor record DRAFT — when you run processing on a client's behalf. It is its own record, organised per client, and by law it carries no purpose, lawful basis, retention or data-subject categories — those are your client's calls on their own record. You declare the scope (actsAs in regixo.yml); nothing about it is inferred. The DRAFT is free and complete on its own; signing it is not built yet.
• An agent-readable catalog — the read-only MCP server and /api/v1 above, so a script or an agent can query the map without anything leaving the machine.

The map that scan produces: what was reached, what is personal, who classified each column — and the record still a DRAFT until a human signs.

• Mechanical facts — what data exists and where it flows — are auto-filled and traced to the schema they came from.
• Legal judgments — purpose, lawful basis, retention — are suggested and marked needs you. No code path can confirm a legal field; a human always signs.

The free product is complete and free forever. Paid (published pricing: €6,000 / €12,000 / from €18,000 a year) adds only defensibility: the signed, offline-verifiable OFFICIAL record and the validated DORA xBRL-CSV export.

Not yet on sale. The hosted portal has not launched and nothing is purchasable — the price is published here because it will never be "contact us", not because you can buy today. Two specifics, so nobody is surprised: seals are currently made with a provisional signing key and carry no timestamp counter-stamp (see ATTESTATION_KEYS.md), and the DORA xBRL-CSV builder refuses to run until its taxonomy constants are verified.

1. Scan — the scanner reads metadata only (names, types, owners, lineage), never row values.
2. Classify — a multilingual, rule-based classifier flags the personal-data columns.
3. Draft — the engine writes the RoPA (and the DORA register, if in scope) as a DRAFT.
4. Hand off — regixo invite forwards the DRAFT; the compliance team claims and signs it.
5. Stay current — regixo watch re-scans, logs what changed, and flags a signed record for re-signing when a legal-relevant field moves.

Want the map to stay current on its own? A ready-to-copy GitHub Actions workflow runs regixo watch --ci on a schedule: examples/github-actions/regixo-watch.yml.

In active development (pre-1.0). Pre-release builds are on npm for early testing; the complete product launches when it's ready. The paid unlock and the hosted portal open at launch — nothing is purchasable yet. The dated build history is in CHANGELOG.md.

Prerequisites: Node 22.18 (nvm use reads .nvmrc) and pnpm 9 (corepack enable).

pnpm install
pnpm typecheck
node --test "packages/**/test/**/*.test.mjs"

See CONTRIBUTING.md for the full workflow and the open-core fence rule, and SECURITY.md to report a vulnerability.

packages/            the public, AGPL-3.0 catalog — the whole product lives here
  cli/               the `regixo` command
  scanner/           drives connectors, builds the map
  connectors/        per-source adapters (sql · saas · dbt · manual · script/BYOC)
  store/             local SQLite + files
  compliance-core/   RoPA/DORA DRAFT generation + schemas (DRAFT only)
  catalog-read/      the shared read layer behind /api/v1 and regixo mcp
  web-data-lens/     the free portal
  ports/             interfaces the paid layer implements
  sim-data/          DEV-ONLY synthetic-customer generator (never shipped)

This repository is a complete, working free catalog on its own. The paid portal — attestation, immutable versioning, official export, SSO — is a separate, proprietary project that plugs into the ports/ interfaces only when Regixo runs the hosted service. None of its code ships here.

• One command (npx regixo start), ~5 min, no Docker — Node ≥ 22.18 the only prerequisite.
• Raw data never leaves the machine — the scanner reads metadata only.
• The system attests mechanical facts only; a human confirms and signs every legal field.
• Free is free forever and complete on its own; paid adds only defensibility.
• The open-core fence is a one-way door: the paid layer is a separate private project, never published here.

Public packages under packages/: AGPL-3.0-only (see LICENSE). The proprietary paid layer is separately licensed and is not part of this repository.