Complai is a compliance product, so we hold ourselves to the bar we help our customers hit. This page documents what we do today, what's in progress, and the direct contact path for security questions.
All systems operational Live status →TLS 1.2+ in transit and AES-256 at rest on every primary store. No customer data leaves an encrypted channel.
Employee access to production data is role-scoped, audit-logged, and reviewed quarterly. MFA required for all admin surfaces.
We use a deliberately small set of vendors. Every one is listed below with what it processes and a link to its DPA.
We operate our own platform against the same control families we help our customers measure themselves on. Our active SOC 2 Type I audit is tracking to close by end of Q3 2026; ISO 27001 readiness work begins immediately after.
If you need a current security questionnaire response, vendor-risk-assessment (VRA) package, or copies of audit artefacts, email security@mycomplai.com and we'll respond within two business days.
The full list of third parties that process customer data on our behalf. We notify customers of material changes (additions, region changes) at least 30 days before they take effect.
| Provider | Purpose | Data region | DPA |
|---|---|---|---|
| Supabase | Primary database, authentication store, object storage | EU / US (configurable) | DPA |
| Clerk | End-user authentication and session management for the dashboard | US | DPA |
| Anthropic (Claude API) | AI generation of questionnaire answers, policies, and gap reports | US | Privacy |
| Stripe | Payment processing and subscription management | US / EU | DPA |
| Resend | Transactional email delivery | US | Privacy |
| Vercel | Application hosting, edge delivery, and serverless compute | Global edge (primary: US-East) | DPA |
What we collect: the business email, company name, and answers you or your colleagues submit through the Complai dashboard. We do not collect payment card numbers, government IDs, or sensitive categories of personal data.
Where it lives: all primary customer data is stored in Supabase Postgres. We prefer EU project regions where available.
How long we keep it:
Training. Customer submissions are never used to train third-party foundation models. Anthropic's API commitment not to train on customer data is confirmed in writing in their commercial terms.
preload + includeSubDomains.master.Our incident response runbook is triggered by either an internal alert (error-rate spike, dependency check failure on /api/health) or an external report to security@mycomplai.com.
Response commitments:
Responsible disclosure. If you believe you've found a vulnerability, please email us rather than filing a public issue. We do not currently run a paid bounty programme, but we credit reporters with permission and commit to not pursuing legal action against good-faith research.
Complai uses Anthropic's Claude API to generate questionnaire answers, policy drafts, and gap analyses. Important commitments:
Our public status page lives at app.mycomplai.com/status. It is driven by a live health probe against our backend API and updates on every request — no cached dashboards.
For programmatic monitoring, the JSON endpoint is
app.mycomplai.com/api/health:
returns 200 with { status: "ok" } when healthy, 503 when any
dependency is degraded. Safe to poll at any frequency; no authentication required.
Vulnerability disclosure, suspected incident, or general security questions.
security@mycomplai.comData subject requests, DPA enquiries, sub-processor notifications.
privacy@mycomplai.com