WE HOLD YOUR AUDIT STORY. WE ACT LIKE IT.
Security at Complies
A compliance product has to model good compliance. Your data at Complies is encrypted in transit and at rest, access is role-based, logged, and MFA-protected, you can export or delete everything on request, and our subprocessor list is published on this page. Here is how we handle the data you trust us with.
Encryption in transit and at rest
All traffic is TLS 1.2+. Data at rest is encrypted with AES-256 on managed infrastructure. Secrets live in a managed vault, never in code or tickets.
Access on a need-to-know basis
Role-based access with least privilege, mandatory MFA for staff, and access reviews on a schedule. Production access is logged, and the log is itself evidence we keep.
Your data leaves when you say so
Export everything your team put in at any time. On request or on cancellation, we delete your data on a defined schedule and confirm when it is done.
Subprocessors, listed
We run on a short list of infrastructure and email subprocessors, published here and updated before any change. No selling, sharing, or training on your compliance data. Ever.
Backups and continuity
Encrypted backups on a rolling schedule, restore drills actually performed, and an incident response plan with named owners, the same discipline we ask of you.
DPA and security review
A data processing agreement is available on the Enterprise tier, and we answer security questionnaires and reviews as part of procurement. Ask via the contact page.
Who touches your data, and why
The short list. We notify before adding or changing a subprocessor.
| Subprocessor | Purpose | Region |
|---|---|---|
| Amazon Web Services | Application hosting, storage, backups | EU / US |
| Cloudflare | DNS, TLS, DDoS protection | Global edge |
| Transactional email provider | Signup confirmation and product email | EU |
Questions procurement wants answered in writing, DPAs, and security reviews all go through the contact page. Data-handling details for customers are in the privacy policy.
Compliance software that takes its own advice
See how the product itself works on the compliance automation page, or start now.
Complies assists with compliance workflows. It is not legal advice, and it does not certify you or guarantee audit outcomes. Your auditor decides; Complies gets you ready.