Security
Careful with your documents.
Your policies and evidence are the heart of your compliance. Here is how Compleka looks after them, in plain English.
Each company’s data is kept separate
Your data is kept separate from other companies’ data in the application, and every query is scoped to your company.
Encrypted with a per-company key
Documents and evidence files are encrypted at rest with a key specific to each company.
Multi-factor authentication
Sign in with an authenticator app, with backup codes. Company admins can require it for every user, and it is mandatory for platform administrators.
Sessions that end
Sessions end after 30 minutes idle and 24 hours at most. Logging out revokes the session on the server.
Cookies, not browser storage
Session tokens are held in httpOnly cookies, not in browser storage.
Rate-limited sign-in
Login and password-reset endpoints are rate-limited.
An audit log
Sign-ins and significant actions are recorded.
Guarded AI input
Document content is handled with safeguards against prompt injection when it is sent to the AI.
About the AI
AI drafts. People approve.
Answers are drawn from your own documents and cite the policy they came from.
AI-drafted policies and edits are downloaded for a person to review. They are never added to your evidence base automatically.
Your documents are not used to train AI models. See our privacy policy.
Hosting and assurance
Where your data lives.
Compleka is hosted in the UK on Amazon Web Services.
AI features use a third-party AI provider as a sub-processor. Our privacy policy lists our sub-processors.
Responsible disclosure
Found something?
If you think you have found a security issue, please email security@compleka.com. Our contact details are also in security.txt.
Try it on your own documents.
Start a 14-day free trial. Or talk it through with us first.
Full platform access during the trial. AI features run on prepaid credit.