Roles, audit, and no outbound calls.
Three questions every security review asks, and three answers you can show rather than assert.
An audit log row
The problem
"Hidden in the UI" is not a permission.
A button that is not rendered still exists on the server. A penetration test finds it in ten minutes, and the audit team asks about it before that.
- 01
Two roles
Administrator and operator. An operator sees the calendar, the inventory and the dashboard, sets event status and fills in checklists. Creating, editing, cancelling and settings — no.
- 02
Enforced server-side
The separation is enforced at the endpoint, not in the interface. Hiding a button is a convenience; the server-side check is the permission.
- 03
Sign-in
Authentication against Active Directory. Session length and attempt limits are editable, and every rejection is logged with its reason in its own file.
- 04
Audit
Every change is recorded. Permanently deleting an event removes what derives from it — but not the audit log, which is the record that the deletion happened.
| Clause | What it requires | What Regulaxy produces |
|---|---|---|
| §61.4 | Patches applied within a timeframe matching the asset's criticality | Derived due dates, a BIA-weighted score, and a patch register |
| §97 | A defined approval procedure for emergency changes and a named approver | A recorded system-owner approval, with a timestamp |
| §98 | Retention of a record of the activities performed during the change | A completed checklist and an audit log that survives deletion |
Regulaxy supplies the evidence. Compliance itself belongs to the bank — the Banking Supervision Department does not approve products, and no vendor can satisfy the directive on your behalf.
What it looks like
An audit row
Regulaxy
Application server and database, on your side
- Active Directory — authentication and roles
- Your database — all application data
- System logs — split by function
No external identity provider and no dependency on a cloud service.
- Active Directory / LDAP
- Local system logs
- Your database
Show us your worst window.
Bring the one that keeps slipping. Thirty minutes, your estate, no slides.